7.8

CVE-2026-20245: Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability

CVSS: 7.8v3.1HighKEVAnalyzed
Published 04-06-2026Last modified 21-07-2026
Open JSON

Vulnerability summary

CVE-2026-20245 is a high (CVSS 7.8) Improper Encoding or Escaping of Output vulnerability in Cisco Catalyst SD-WAN Manager. It is known to be exploited: CISA and CIRCL list it, first on 09-06-2026. EPSS estimates a 25.32% chance of exploitation in the next 30 days, higher than 97.9% of scored vulnerabilities.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
25.32%
0%100%
High · 0.00 pp in 30 days
KEVListedCISA · CIRCL
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 04-06-2026
    PublishedVulnerability first disclosed.
  2. 09-06-2026
    Added to CISA KEVCisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability
  3. 23-06-2026
    CISA remediation dueApply mitigations per vendor instructions.
  4. 25-06-2026
    Added to CIRCL KEVAdded to the CIRCL known exploited vulnerabilities catalog.
  5. 21-07-2026
    Last modifiedVulnerability information updated.

Description

A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user. To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices. Cisco recommends that customers upgrade to the fixed software that is documented in the that was published on May 14, 2026, and verify the configuration of the edge devices.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

25.32%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

0.00 pp

From 25.32% on 19-09-2026

19-09-202619-10-2026
EPSS score
25.32%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
09-06-2026
Federal due date
23-06-2026
CIRCLListed
Added
25-06-2026

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. sec.cloudapps.cisco.com/security/… nvd.nist.gov/vuln/detail/CVE-2026-20245

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Cisco4 products
  • catalyst_sd-wan_manager< 20.9.9.1 | ≥ 20.10, < 20.12.5.4 | ≥ 20.12.6, < 20.12.6.2 | ≥ 20.13, < 20.15.4.4 | ≥ 20.15.5, < 20.15.5.2 | ≥ 20.16, < 20.18.2.2 | ≥ 26.1, < 26.1.1.1 | 20.12.7
  • cisco catalyst sd-wan controller20.6.4 | 20.9.2 | 20.3.6 | 20.7.2 | 20.7.1 | 20.5.1 | 20.6.2 | 19.3.0 | 20.6.1 | 17.2.4 | 18.2.0 | 18.4.6 | 19.1.0 | 19.2.4 | 19.2.929 | 18.3.8 | 18.4.303 | 18.3.7 | 18.4.1 | 19.2.097 | 19.2.0 | 19.2.099 | 18.3.6 | 20.4.2 | 19.0.0 | 20.9.1 | 20.3.5 | 20.3.1 | 18.3.5 | 20.6.3 | 18.4.3 | 18.4.4 | 18.3.3 | 17.2.8 | 20.8.1 | 19.2.32 | 19.2.2 | 17.2.5 | 18.4.0 | 20.4.1.1 | 20.1.3 | 20.1.2 | 17.2.10 | 19.2.098 | 20.1.1 | 17.2.6 | 19.2.1 | 18.3.4 | 20.4.1 | 17.2.9 | 19.2.31 | 19.0.1a | 18.3.0 | 17.2.7 | 18.4.5 | 20.3.4 | 20.3.3 | 20.4.1.2 | 20.3.2 | 18.3.1 | 20.1.12 | 19.2.3 | 20.10.1 | 20.6.5 | 20.3.7 | 20.9.3 | 20.11.1 | 20.6.3.2 | 20.4.2.3 | 20.3.5.1 | 20.3.4.3 | 20.9.3.1 | 20.6.4.1 | 20.3.3.2 | 20.6.5.2 | 20.3.7.1 | 20.11.1.1 | 20.10.1.1 | 20.6.1.2 | 20.13.1 | 20.9.2.2 | 20.6.5.3 | 20.6.3.3 | 20.3.7.2 | 20.6.5.4 | 20.9.2.3 | 20.9.4 | 20.12.1 | 20.3.8 | 20.6.6 | 20.12.2 | 20.9.5 | 20.12.3 | 20.6.7 | 20.9.5.1 | 20.14.1 | 20.12.3.1 | 20.12.4 | 20.15.1 | 20.9.6 | 20.6.8 | 20.16.1 | 20.9.5.3 | 20.12.4.1 | 20.15.2 | 20.12.5 | 20.9.7 | 20.15.3 | 20.12.5.1 | 20.12.5.2 | 20.15.4 | 20.9.7.1 | 20.18.1 | 20.12.6 | 20.9.8 | 20.15.4.1 | 20.18.2 | 26.1.1 | 20.15.4.2 | 20.18.2.1 | 20.12.5.3 | 20.12.6.1 | 20.9.8.2 | 20.15.5 | 20.18.3 | 20.12.7 | 20.9.9 | 20.18.2.2 | 20.12.5.4 | 20.12.7.1 | 20.15.5.1 | 20.15.4.3 | 20.12.6.2 | 20.15.5.2 | 20.15.4.4 | 26.1.1.1 | 20.9.9.1 | 26.1.1.2 | 20.15.4.5 | 20.15.5.3
  • cisco catalyst sd-wan manager20.1.12 | 19.2.1 | 18.4.4 | 18.4.5 | 20.11.1 | 20.1.1 | 19.3.0 | 19.2.2 | 19.2.099 | 18.3.6 | 18.3.7 | 19.2.0 | 18.3.8 | 19.0.0 | 19.1.0 | 18.4.302 | 18.4.303 | 19.2.097 | 19.2.098 | 17.2.10 | 18.3.6.1 | 19.0.1a | 18.2.0 | 18.4.3 | 18.4.1 | 17.2.8 | 18.3.3.1 | 18.4.0 | 18.3.1 | 17.2.6 | 17.2.9 | 18.3.4 | 17.2.5 | 18.3.1.1 | 18.3.5 | 18.4.0.1 | 18.3.3 | 17.2.7 | 17.2.4 | 18.3.0 | 19.2.3 | 18.4.501_ES | 20.3.1 | 20.1.2 | 19.2.929 | 19.2.31 | 20.3.2 | 19.2.32 | 20.3.2_925 | 20.3.2.1 | 20.3.2.1_927 | 18.4.6 | 20.1.2_937 | 20.4.1 | 20.3.2_928 | 20.3.2_929 | 20.4.1.0.1 | 20.3.2.1_930 | 19.2.4 | 20.5.0.1.1 | 20.4.1.1 | 20.3.3 | 19.2.4.0.1 | 20.3.2_937 | 20.3.3.1 | 20.5.1 | 20.1.3 | 20.3.3.0.4 | 20.3.3.1.2 | 20.3.3.1.1 | 20.4.1.2 | 20.3.3.0.2 | 20.4.1.1.5 | 20.4.1.0.01 | 20.4.1.0.02 | 20.3.3.1.7 | 20.3.3.1.5 | 20.5.1.0.1 | 20.3.3.1.10 | 20.3.3.0.8 | 20.4.2 | 20.4.2.0.1 | 20.3.4 | 20.3.3.0.14 | 19.2.4.0.8 | 19.2.4.0.9 | 20.3.4.0.1 | 20.3.2.0.5 | 20.6.1 | 20.5.1.0.2 | 20.3.3.0.17 | 20.6.1.1 | 20.6.0.18.3 | 20.3.2.0.6 | 20.6.0.18.4 | 20.4.2.0.2 | 20.3.3.0.16 | 20.3.4.0.5 | 20.6.1.0.1 | 20.3.4.0.6 | 20.6.2 | 20.7.1EFT2 | 20.3.4.0.9 | 20.3.4.0.11 | 20.4.2.0.4 | 20.3.3.0.18 | 20.7.1 | 20.6.2.1 | 20.3.4.1 | 20.5.1.1 | 20.4.2.1 | 20.4.2.1.1 | 20.3.4.1.1 | 20.3.813 | 20.3.4.0.19 | 20.4.2.2.1 | 20.5.1.2 | 20.3.4.2 | 20.3.814 | 20.4.2.2 | 20.6.2.2 | 20.3.4.2.1 | 20.7.1.1 | 20.3.4.1.2 | 20.6.2.2.2 | 20.3.4.0.20 | 20.6.2.2.3 | 20.4.2.2.2 | 20.3.5 | 20.6.2.0.4 | 20.4.2.2.3 | 20.3.4.0.24 | 20.6.2.2.7 | 20.6.3 | 20.3.4.2.2 | 20.4.2.2.4 | 20.7.1.0.2 | 20.8.1 | 20.3.5.0.8 | 20.3.5.0.9 | 20.4.2.2.8 | 20.3.5.0.7 | 20.6.3.0.7 | 20.6.3.0.5 | 20.6.3.0.10 | 20.6.3.0.2 | 20.7.2 | 20.9.1EFT2 | 20.6.3.0.11 | 20.6.3.1 | 20.6.3.0.14 | 20.6.4 | 20.9.1 | 20.6.3.0.19 | 20.6.3.0.18 | 20.3.6 | 20.9.1.1 | 20.6.3.0.23 | 20.6.4.0.4 | 20.6.3.0.25 | 20.6.5 | 20.6.3.0.27 | 20.9.2 | 20.9.2.1 | 20.6.3.0.29 | 20.6.3.0.31 | 20.6.3.0.32 | 20.10.1 | 20.6.3.0.33 | 20.9.2.0.01 | 20.9.1_LI_Images | 20.10.1_LI_Images | 20.9.2_LI_Images | 20.3.7 | 20.9.3 | 20.6.5.1 | 20.11.1_LI_Images | 20.9.3_LI_ Images | 20.6.3.1.1 | 20.9.3.0.2 | 20.6.5.1.2 | 20.9.3.0.3 | 20.4.2.3 | 20.6.3.2 | 20.6.4.1 | 20.6.3.0.38 | 20.6.3.0.39 | 20.3.5.1 | 20.3.4.3 | 20.9.3.1 | 20.3.3.2 | 20.6.5.2 | 20.3.7.1 | 20.10.1.1 | 20.6.5.2.1 | 20.3.4.0.25 | 20.6.2.2.4 | 20.6.1.2 | 20.11.1.1 | 20.9.3.0.5 | 20.3.4.0.26 | 20.6.5.1.3 | 20.6.3.0.40 | 20.13.1 | 20.9.2.2 | 20.6.5.2.3 | 20.6.5.1.4 | 20.6.5.3 | 20.6.3.0.41 | 20.9.3.0.7 | 20.6.5.1.5 | 20.9.3.0.4 | 20.6.4.0.19 | 20.6.5.1.6 | 20.9.3.0.8 | 20.6.3.3 | 20.3.7.2 | 20.6.5.4 | 20.6.5.1.7 | 20.9.3.0.12 | 20.6.4.2 | 20.6.5.5 | 20.9.3.2 | 20.11.1.2 | 20.6.3.4 | 20.10.1.2 | 20.6.5.1.9 | 20.9.3.0.16 | 20.6.3.0.45 | 20.6.5.1.10 | 20.9.3.0.17 | 20.6.5.2.4 | 20.6.4.0.21 | 20.9.3.0.18 | 20.6.3.0.46 | 20.6.3.0.47 | 20.9.2.3 | 20.9.3.2_LI_Images | 20.9.3.0.21 | 20.9.3.0.20 | 20.9.4_LI_Images | 20.9.4 | 20.6.5.1.11 | 20.12.1 | 20.12.1_LI_Images | 20.6.5.1.13 | 20.9.3.0.23 | 20.6.5.2.8 | 20.9.4.1 | 20.9.4.1_LI_Images | 20.9.3.0.25 | 20.9.3.0.24 | 20.6.5.1.14 | 20.3.8 | 20.6.6 | 20.9.3.0.26 | 20.6.3.0.51 | 20.9.3.0.29 | 20.12.2 | 20.12.2_LI_Images | 20.6.6.0.1 | 20.13.1_LI_Images | 20.9.4.0.4 | 20.9.4.1.1 | 20.9.5 | 20.9.5_LI_Images | 20.12.3_LI_Images | 20.12.3 | 20.9.4.1.3 | 20.6.7 | 20.9.5.1 | 20.9.5.1_LI_Images | 20.9.4.1.6 | 20.14.1 | 20.14.1_LI_Images | 20.9.5.2 | 20.9.5.2.1 | 20.9.5.2_LI_Images | 20.12.3.1 | 20.12.4 | 20.15.1_LI_Images | 20.15.1 | 20.9.5.1.4 | 20.9.5.2.7 | 20.9.5.2.13 | 20.9.6 | 20.9.6_LI_Images | 20.9.5.2.14 | 20.6.8 | 20.12.4.0.03 | 20.16.1 | 20.16.1_LI_Images | 20.12.4_LI_Images | 20.9.5.2.16 | 20.12.4.0.4 | 20.12.401 | 20.9.5.3 | 20.9.5.3_LI_Images | 20.12.4.1_LI_Images | 20.12.4.1 | 20.9.5.2.21 | 20.9.6.0.3 | 20.12.4.0.6 | 20.15.2_LI_Images | 20.15.2 | 20.12.4_Monthly_ES5 | 20.12.5 | 20.12.5_LI_Images | 20.9.7_LI _Images | 20.9.7 | 20.15.3 | 20.15.3_ LI _Images | 20.12.501 | 20.12.5.1_LI_Images | 20.12.5.1 | 20.12.5.2_LI_Images | 20.12.5.2 | 20.15.3.1 | 20.15.4_LI_Images | 20.15.4 | 20.9.7.1_LI _Images | 20.9.7.1 | 20.18.1 | 20.18.1_LI_Images | 20.12.6_LI_Images | 20.12.6 | 20.12.5.1.01 | 26.0.1 | 20.9.8 | 20.9.8_LI_Images | 20.18.2 | 20.15.4.1_LI_Images | 20.15.4.1 | 20.18.2_LI_Images | 26.1.1 | 26.1.1_LI_Images | 20.18.2.1_LI_Images | 20.18.2.1 | 20.15.4.2_LI_Images | 20.15.4.2 | 20.12.6.1 | 20.12.6.1_LI_Images | 20.12.5.3 | 20.12.5.3_LI_Images | 20.9.8.2_LI_Images | 20.9.8.2 | 20.18.3 | 20.18.3_LI_Images | 20.15.5 | 20.15.5_LI_Images | 20.12.7 | 20.12.7_LI_Images | 20.9.9 | 20.9.9_LI_Images | 20.18.2.2 | 20.18.2.2_LI_Images | 20.12.5.4 | 20.12.5.4_LI_ Images | 20.12.7.1_LI_Images | 20.12.6.2_LI_Images | 20.12.7.1 | 20.15.5.1 | 20.15.4.3 | 20.15.4.3_LI_Images | 20.15.5.1_LI_Images | 20.12.6.2 | 20.15.5.2 | 20.15.5.2_LI_Images | 26.1.1.1_LI_Images | 20.15.4.4 | 20.15.4.4_LI_Images | 26.1.1.1 | 20.9.9.1_LI_Images | 20.9.9.1
  • sd-wan_vsmart_controller< 20.9.9.1 | ≥ 20.10, < 20.12.5.4 | ≥ 20.12.6, < 20.12.6.2 | ≥ 20.13, < 20.15.4.4 | ≥ 20.15.5, < 20.15.5.2 | ≥ 20.16, < 20.18.2.2 | ≥ 26.1, < 26.1.1.1 | 20.12.7

1 vendor · 4 products

References

3 links