GoKawiilAmid a stream of new vulnerabilities in Cisco's Catalyst SD-WAN Manager, some researchers are arguing that organizations have misplaced their focus, hyperfixating on one critical vulnerability with a lot of noise around it, but overlooking another, quieter bug that's just as serious.
On Feb. 25, Cisco publicly disclosed half a dozen newfound bugs in its Software-Defined Wide Area Network (SD-WAN) management product. At least three have been exploited in the wild. One, CVE-2026-20127, in addition to earning the highest possible 10 out of 10 score in the Common Vulnerability Scoring System (CVSS), appears to have been exploited as a zero-day by one threat actor for at least three years.
In that light, it's no wonder that CVE-2026-20127 attracted as much attention as it has. And yet, some other reasons for concern have been less well-founded. Researchers at VulnCheck found that public proof-of-concept (PoC) exploits for this issue have been a mixed bag: some are outright fake, some are misleading, and all are rather confusing for organizations trying to keep up. And with all the oxygen being taken up by CVE-2026-20127, they argued in a blog post, there's another vulnerability in the mix that's not getting as much attention as it should: CVE-2026-20133.
Related:Cisco Drops 48 New Firewall Vulnerabilities, 2 Critical
CVE-2026-20127 vs. CVE-2026-20133
Though CVE-2026-20127 is certainly worth time and attention, VulnCheck's researchers found that CVE-2026-20133 can also be used to interesting effect. This less heralded issue is an information-disclosure bug that earned a high-severity 7.5 out of 10 CVSS score. It isn't known to have been exploited in the wild yet.
When the researchers played around with CVE-2026-20133, they found that the file system access it affords allowed them to grab the private key associated with the default "vmanage-admin" user. That key allowed them to compromise the Network Configuration Protocol (NETCONF) used to configure and manage SD-WAN devices. They also leaked a shared secret for internal communication — "confd_ipc_secret" — which could allow any local user to escalate to root. Besides just enjoying access, attackers could use these kinds of secrets to push configuration changes to an organization's network, manipulate traffic ingress and egress, and theoretically much more.
VulnCheck couldn't get a precise gauge on how many Cisco SD-WAN Managers are publicly accessible from the Internet, as different search engines returned anywhere from 275 to thousands of results. In addition to patching, organizations can consider reducing their exposure to CVE-2026-20127, CVE-2026-20133, and other vulnerabilities like them by removing their systems from the browsable Web.
Related:Cisco SD-WAN Zero-Day Under Exploitation for 3 Years
Don't Be Fooled by Fake PoCs
... continue reading