CVE-2026-20129: Cisco Catayst SD-WAN Authentication Bypass Vulnerability

Description

A vulnerability in the API user authentication of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain access to an affected system as a user who has the netadmin role. The vulnerability is due to improper authentication for requests that are sent to the API. An attacker could exploit this vulnerability by sending a crafted request to the API of an affected system. A successful exploit could allow the attacker to execute commands with the privileges of the netadmin role. Note: Cisco Catalyst SD-WAN Manager releases 20.18 and later are not affected by this vulnerability. 

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cisco Cisco Catalyst SD-WAN Manager

Default version status: unknown

20.1.12affected
19.2.1affected
18.4.4affected
18.4.5affected
20.1.1.1affected
20.1.1affected
19.3.0affected
19.2.2affected
19.2.099affected
18.3.6affected
18.3.7affected
19.2.0affected
18.3.8affected
19.0.0affected
19.1.0affected
18.4.302affected
18.4.303affected
19.2.097affected
19.2.098affected
17.2.10affected
18.3.6.1affected
19.0.1aaffected
18.2.0affected
18.4.3affected
18.4.1affected
17.2.8affected
18.3.3.1affected
18.4.0affected
18.3.1affected
17.2.6affected
17.2.9affected
18.3.4affected
17.2.5affected
18.3.1.1affected
18.3.5affected
18.4.0.1affected
18.3.3affected
17.2.7affected
17.2.4affected
18.3.0affected
19.2.3affected
18.4.501_ESaffected
20.3.1affected
20.1.2affected
19.2.929affected
19.2.31affected
20.3.2affected
19.2.32affected
20.3.2_925affected
20.3.2.1affected
20.3.2.1_927affected
18.4.6affected
20.1.2_937affected
20.4.1affected
20.3.2_928affected
20.3.2_929affected
20.4.1.0.1affected
20.3.2.1_930affected
19.2.4affected
20.5.0.1.1affected
20.4.1.1affected
20.3.3affected
19.2.4.0.1affected
20.3.2_937affected
20.3.3.1affected
20.5.1affected
20.1.3affected
20.3.3.0.4affected
20.3.3.1.2affected
20.3.3.1.1affected
20.4.1.2affected
20.3.3.0.2affected
20.4.1.1.5affected
20.4.1.0.01affected
20.4.1.0.02affected
20.3.3.1.7affected
20.3.3.1.5affected
20.5.1.0.1affected
20.3.3.1.10affected
20.3.3.0.8affected
20.4.2affected
20.4.2.0.1affected
20.3.4affected
20.3.3.0.14affected
19.2.4.0.8affected
19.2.4.0.9affected
20.3.4.0.1affected
20.3.2.0.5affected
20.6.1affected
20.5.1.0.2affected
20.3.3.0.17affected
20.6.1.1affected
20.6.0.18.3affected
20.3.2.0.6affected
20.6.0.18.4affected
20.4.2.0.2affected
20.3.3.0.16affected
20.3.4.0.5affected
20.6.1.0.1affected
20.3.4.0.6affected
20.6.2affected
20.7.1EFT2affected
20.3.4.0.9affected
20.3.4.0.11affected
20.4.2.0.4affected
20.3.3.0.18affected
20.7.1affected
20.6.2.1affected
20.3.4.1affected
20.5.1.1affected
20.4.2.1affected
20.4.2.1.1affected
20.3.4.1.1affected
20.3.813affected
20.3.4.0.19affected
20.4.2.2.1affected
20.5.1.2affected
20.3.4.2affected
20.3.814affected
20.4.2.2affected
20.6.2.2affected
20.3.4.2.1affected
20.7.1.1affected
20.3.4.1.2affected
20.6.2.2.2affected
20.3.4.0.20affected
20.6.2.2.3affected
20.4.2.2.2affected
20.3.5affected
20.6.2.0.4affected
20.4.2.2.3affected
20.3.4.0.24affected
20.6.2.2.7affected
20.6.3affected
20.3.4.2.2affected
20.4.2.2.4affected
20.7.1.0.2affected
20.8.1affected
20.3.5.0.8affected
20.3.5.0.9affected
20.4.2.2.8affected
20.3.5.0.7affected
20.6.3.0.7affected
20.6.3.0.5affected
20.6.3.0.10affected
20.6.3.0.2affected
20.7.2affected
20.9.1EFT2affected
20.6.3.0.11affected
20.6.3.1affected
20.6.3.0.14affected
20.6.4affected
20.9.1affected
20.6.3.0.19affected
20.6.3.0.18affected
20.3.6affected
20.9.1.1affected
20.6.3.0.23affected
20.6.4.0.4affected
20.6.3.0.25affected
20.6.5affected
20.6.3.0.27affected
20.9.2affected
20.9.2.1affected
20.6.3.0.29affected
20.6.3.0.31affected
20.6.3.0.32affected
20.10.1affected
20.6.3.0.33affected
20.9.2.0.01affected
20.9.1_LI_Imagesaffected
20.10.1_LI_Imagesaffected
20.9.2_LI_Imagesaffected
20.3.7affected
20.9.3affected
20.6.5.1affected
20.11.1affected
20.11.1_LI_Imagesaffected
20.9.3_LI_ Imagesaffected
20.6.3.1.1affected
20.9.3.0.2affected
20.6.5.1.2affected
20.9.3.0.3affected
20.4.2.3affected
20.6.3.2affected
20.6.4.1affected
20.6.3.0.38affected
20.6.3.0.39affected
20.3.5.1affected
20.3.4.3affected
20.9.3.1affected
20.3.3.2affected
20.6.5.2affected
20.3.7.1affected
20.10.1.1affected
20.6.5.2.1affected
20.3.4.0.25affected
20.6.2.2.4affected
20.6.1.2affected
20.11.1.1affected
20.9.3.0.5affected
20.3.4.0.26affected
20.6.5.1.3affected
20.6.3.0.40affected
20.1.3.1affected
20.9.2.2affected
20.6.5.2.3affected
20.6.5.1.4affected
20.6.5.3affected
20.6.3.0.41affected
20.9.3.0.7affected
20.6.5.1.5affected
20.9.3.0.4affected
20.6.4.0.19affected
20.6.5.1.6affected
20.9.3.0.8affected
20.6.3.3affected
20.3.7.2affected
20.6.5.4affected
20.6.5.1.7affected
20.9.3.0.12affected
20.6.4.2affected
20.6.5.5affected
20.9.3.2affected
20.11.1.2affected
20.6.3.4affected
20.10.1.2affected
20.6.5.1.9affected
20.9.3.0.16affected
20.6.3.0.45affected
20.6.5.1.10affected
20.9.3.0.17affected
20.6.5.2.4affected
20.6.4.0.21affected
20.9.3.0.18affected
20.6.3.0.46affected
20.6.3.0.47affected
20.9.2.3affected
20.9.3.2_LI_Imagesaffected
20.9.3.0.21affected
20.9.3.0.20affected
20.9.4_LI_Imagesaffected
20.9.4affected
20.6.5.1.11affected
20.12.1affected
20.12.1_LI_Imagesaffected
20.6.5.1.13affected
20.9.3.0.23affected
20.6.5.2.8affected
20.9.4.1affected
20.9.4.1_LI_Imagesaffected
20.9.3.0.25affected
20.9.3.0.24affected
20.6.5.1.14affected
20.3.8affected
20.6.6affected
20.9.3.0.26affected
20.6.3.0.51affected
20.9.3.0.29affected
20.12.2affected
20.12.2_LI_Imagesaffected
20.6.6.0.1affected
20.13.1_LI_Imagesaffected
20.9.4.0.4affected
20.13.1affected
20.9.4.1.1affected
20.9.5affected
20.9.5_LI_Imagesaffected
20.12.3_LI_Imagesaffected
20.12.3affected
20.9.4.1.3affected
20.6.7affected
20.9.5.1affected
20.9.5.1_LI_Imagesaffected
20.9.4.1.6affected
20.14.1affected
20.14.1_LI_Imagesaffected
20.9.5.2affected
20.9.5.2.1affected
20.9.5.2_LI_Imagesaffected
20.12.3.1affected
20.12.4affected
20.15.1_LI_Imagesaffected
20.15.1affected
20.9.5.1.4affected
20.9.5.2.7affected
20.9.5.2.13affected
20.9.6affected
20.9.6_LI_Imagesaffected
20.9.5.2.14affected
20.6.8affected
20.12.4.0.03affected
20.16.1affected
20.16.1_LI_Imagesaffected
20.12.4_LI_Imagesaffected
20.9.5.2.16affected
20.12.4.0.4affected
20.12.401affected
20.9.5.3affected
20.9.5.3_LI_Imagesaffected
20.12.4.1_LI_Imagesaffected
20.12.4.1affected
20.9.5.2.21affected
20.9.6.0.3affected
20.12.4.0.6affected
20.15.2_LI_Imagesaffected
20.15.2affected
20.12.4_Monthly_ES5affected
20.12.5affected
20.12.5_LI_Imagesaffected
20.9.7_LI _Imagesaffected
20.9.7affected
20.15.3affected
20.15.3_ LI _Imagesaffected
20.12.501affected
20.12.5.1_LI_Imagesaffected
20.12.5.1affected
20.12.5.2_LI_Imagesaffected
20.12.5.2affected
20.15.3.1affected
20.15.4_LI_Imagesaffected
20.15.4affected
20.9.7.1_LI _Imagesaffected
20.9.7.1affected
20.18.1affected
20.18.1_LI_Imagesaffected
20.12.6_LI_Imagesaffected
20.12.6affected
20.12.5.1.01affected
20.9.8affected
20.9.8_LI_Imagesaffected
20.18.2affected
20.15.4.1_LI_Imagesaffected
20.15.4.1affected
20.18.2_LI_Imagesaffected

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v ↗