Cisco Catalyst SD-WAN Manager Data Collection Agent (DCA) Credential Exposure Vulnerability (CVE-2026-20128)

1. Official Patch Application

Upgrade your Cisco Catalyst SD-WAN Manager deployment to Release 20.18 or later, which resolves the credential exposure flaw.

2. Temporary Mitigations (Prior to Patching)

If immediate patching is not feasible, implement the following workarounds:

• Network Access Control (ACLs): Restrict access to the SD-WAN Manager management interfaces and HTTP/HTTPS ports to trusted administrative IP ranges only.
• WAF/IPS Signatures: Deploy Web Application Firewall (WAF) or Intrusion Prevention System (IPS) rules to detect and block unauthorized HTTP GET requests targeting sensitive configuration or credential file paths.
• Disable DCA: Disable the Data Collection Agent (DCA) feature if it is not actively required in your environment.

This vulnerability (CVE-2026-20128) exists in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager due to the insecure storage of a credential file containing the DCA user password on the affected system.

An unauthenticated, remote attacker can exploit this flaw by sending a crafted HTTP request to read the sensitive file containing the DCA password. A successful exploitation allows the attacker to compromise the credential, access other affected systems, and elevate privileges to those of the DCA user.

Given that this vulnerability is listed in the CISA KEV catalog and carries an extremely high EPSS score of 0.94, it represents an active threat that requires immediate remediation.