CVE-2026-20122/20128/20133: Cisco Catalyst SD-WAN Manager Exploitation Chain

Background

Cisco Catalyst SD-WAN Manager (formerly Cisco vManage) is the centralised management platform for Cisco’s SD-WAN fabric. It controls network topology, routing policy, security policy, and device configuration for all SD-WAN edge devices in the deployment. Compromise of the Manager translates directly to control over all managed routers and connectivity policies.

In April 2026, CISA added three related Cisco Catalyst SD-WAN Manager vulnerabilities to the Known Exploited Vulnerabilities catalogue: CVE-2026-20122 (authentication bypass), CVE-2026-20128 (credential file exposure), and CVE-2026-20133 (information disclosure). These three vulnerabilities are being chained in active attacks. An attacker who runs all three can achieve unauthenticated access to the management interface, extract stored credentials including admin password hashes and JWT tokens, and establish persistent access via web shells — no valid credentials required at any stage. Ten distinct threat clusters have been attributed to active exploitation.

Technical Mechanism

The three vulnerabilities form a coherent attack chain:

CVE-2026-20122 — Authentication Bypass (CVSS 7.5) The SD-WAN Manager’s API server improperly validates session tokens for certain API endpoints. An attacker can craft requests that bypass authentication checks, gaining access to restricted API functionality without a valid session. The bypass targets a subset of management API endpoints that handle device configuration and user management operations.

CVE-2026-20128 — Credential File Exposure (CVSS 7.5) The Manager’s file handling logic permits an authenticated (or bypass-authenticated) user to read sensitive credential files from the server filesystem through a path traversal or improper access control in the file download API. Affected files include configuration exports containing hashed administrator passwords, API tokens, and in some deployment configurations, plaintext service account credentials used for inter-component authentication.

CVE-2026-20133 — Information Disclosure (CVSS 7.5) The Manager exposes session metadata and internal JWT (JSON Web Token) signing material through an insufficiently protected endpoint. An attacker who reads this material can forge valid JWT tokens, effectively creating a persistent authentication bypass that survives patching if the signing key is not rotated.

The exploitation chain in practice:

1. Attacker identifies internet-facing SD-WAN Manager instance via Shodan or Censys scanning on TCP/443 or TCP/8443
2. CVE-2026-20122 used to bypass authentication and access restricted API endpoints
3. CVE-2026-20128 exploited to extract credential files — administrator password hashes, service account credentials, and API keys
4. CVE-2026-20133 exploited to extract JWT signing material, enabling token forgery
5. Attacker authenticates with forged JWT or cracked credentials, gaining persistent legitimate-appearing access
6. Web shell deployed to the Manager’s web root for persistent backdoor access
7. Attacker uses Manager API access to extract full SD-WAN topology, push configuration changes, or pivot into managed edge devices

# Step 1 — CVE-2026-20122: Authentication bypass to access a restricted API endpoint
GET /dataservice/device HTTP/1.1
Host: sdwan-manager.target.example.com
Authorization: Bearer eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJhZG1pbiIsInJvbGUiOiJhZG1pbiIsImlhdCI6MTcwMDAwMDAwMH0.
Content-Type: application/json

# Step 2 — CVE-2026-20128: Path traversal to extract credential files
GET /dataservice/disasterrecovery/download?fileName=../../../opt/vmanage/data/vmanage_config.tar.gz HTTP/1.1
Host: sdwan-manager.target.example.com
Authorization: Bearer eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJhZG1pbiIsInJvbGUiOiJhZG1pbiIsImlhdCI6MTcwMDAwMDAwMH0.

# Step 3 — CVE-2026-20133: Extract JWT signing key material
GET /dataservice/client/server HTTP/1.1
Host: sdwan-manager.target.example.com
Authorization: Bearer eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJhZG1pbiIsInJvbGUiOiJhZG1pbiIsImlhdCI6MTcwMDAwMDAwMH0.

The Authorization header in steps 1–3 carries a JWT with "alg":"none" and an empty signature segment (trailing .). The encoded payload asserts admin privileges. When the Manager’s token library accepts unsigned tokens on these code paths, the attacker gains authenticated API access without any valid credential.

Real-World Exploitation Evidence

CISA’s April 2026 KEV additions reflect active exploitation observed in the wild. Threat intelligence reporting documents ten threat clusters exploiting these vulnerabilities since at least March 2026, with exploitation focused on enterprise and service provider SD-WAN deployments.

Observed post-exploitation activity in attributed incidents includes:

• Web shell deployment: Three distinct web shell families have been recovered from compromised SD-WAN Manager instances — Godzilla (Java-based), Behinder (supports multiple backends), and XenShell (a lightweight reconnaissance-focused shell). All three provide interactive remote command execution.
• C2 framework staging: AdaptixC2 and Sliver (open-source C2 frameworks) have been deployed on compromised Manager hosts as persistent backdoors, with encrypted command-and-control traffic blending into expected HTTPS traffic from the management plane.
• Cryptominer deployment: XMRig cryptocurrency miner has been deployed on compromised hosts — a common indicator of opportunistic financially-motivated actors operating in parallel with more targeted campaigns.
• Credential exfiltration: Admin password hashes, JWT signing secrets, and AWS IAM credentials stored in SD-WAN Manager configuration have been exfiltrated across multiple attributed incidents. AWS credential theft in particular suggests attackers targeting cloud-connected SD-WAN deployments for further cloud environment access.

The breadth of post-exploitation objectives — from persistent access to credential theft to cryptomining — indicates that multiple distinct threat actors across different motivation profiles are exploiting the same vulnerability chain.

Impact Assessment

• Full SD-WAN control plane compromise — an attacker with Manager access can view and modify all routing and security policies across the entire SD-WAN fabric, redirecting or intercepting traffic at network scale
• Credential and key material theft — stored administrator credentials, API keys, JWT signing secrets, and cloud provider credentials (AWS, Azure) are all accessible to an attacker who exploits this chain
• Persistent access via forged tokens — if JWT signing material is extracted, an attacker can generate valid authentication tokens indefinitely; patching the initial bypass does not revoke attacker access if key material is not rotated
• Lateral movement into SD-WAN edge devices — the Manager has privileged configuration access to all managed edge routers; an attacker can push configuration changes that establish backdoor access at the network edge
• Traffic interception — SD-WAN routing policy changes can redirect traffic flows for interception or man-in-the-middle attacks against network-level communications
• Cloud environment access — in deployments where SD-WAN Manager is integrated with AWS or Azure, extracted cloud credentials enable pivoting into the cloud environment

Affected Versions

CVE-2026-20122, CVE-2026-20128, and CVE-2026-20133 are all addressed in the same patch releases. Apply a single upgrade to remediate all three vulnerabilities.

Remediation Steps

1. Upgrade immediately — apply fixed SD-WAN Manager releases (20.12.4, 20.11.5, or 20.9.7) following Cisco advisory cisco-sa-sdwan-mgr-2026; follow Cisco’s documented upgrade procedures to avoid data plane disruption

   # Verify current SD-WAN Manager version from vManage CLI
   show sdwan version
   
   # Check for unexpected .jsp or .war files in Tomcat webapps (web shell detection)
   find /opt/cisco/vmanage/tomcat/webapps/ -name "*.jsp" -o -name "*.war" | \
     xargs ls -la 2>/dev/null
   
   # Check for unexpected cron or systemd persistence
   crontab -l -u vmanage 2>/dev/null
   systemctl list-units --type=service --state=running | grep -v cisco

2. Restrict management plane access — the SD-WAN Manager web interface should not be internet-facing; if remote access is required, place the management interface behind a VPN with MFA, or use Cisco’s out-of-band management network; apply IP-based ACLs to limit access to known administrator source addresses

   ! Cisco IOS-XE: apply ACL to restrict vManage management interface access
   ip access-list extended SDWAN-MGMT-ACL
    permit tcp 10.0.0.0 0.255.255.255 host <vmanage-ip> eq 443
    permit tcp 172.16.0.0 0.15.255.255 host <vmanage-ip> eq 443
    deny   tcp any host <vmanage-ip> eq 443 log
    deny   tcp any host <vmanage-ip> eq 8443 log
    permit ip any any

3. Rotate all stored credentials after patching — assume all credentials stored in the Manager (admin accounts, API keys, service account passwords, cloud provider credentials) are compromised if the instance was internet-accessible before patching; rotate them all

4. Invalidate and regenerate JWT signing keys — if JWT signing material may have been exposed, regenerate the signing keys used by the Manager’s authentication subsystem to invalidate all existing tokens, including any forged by attackers

5. Check for persistent web shells — inspect the Manager’s web root directories for unexpected .jsp, .war, .php, or script files; check scheduled tasks and cron jobs for attacker-added persistence mechanisms

6. Audit SD-WAN configuration for unauthorised changes — review the Manager’s configuration audit log for policy changes, new user accounts, or device configuration pushes that occurred after the first exploitation date (March 2026); restore known-good configurations if unauthorised changes are found

7. Rotate cloud credentials — if SD-WAN Manager was integrated with AWS, Azure, or GCP, rotate all associated IAM credentials and review cloud trail logs for suspicious API activity using those credentials

Detection Guidance

Look for the following indicators of exploitation in web server access logs, SD-WAN Manager audit logs, and host-based telemetry:

• Web server access logs showing requests to SD-WAN Manager API endpoints with anomalous authentication headers or without expected session tokens — particularly for endpoints that normally require authentication
• File access logs or audit entries showing reads of sensitive configuration files or credential stores from processes other than the expected SD-WAN Manager application processes
• New files appearing in the SD-WAN Manager web root directories (Tomcat webapps directory or equivalent) — particularly .jsp or .war files not present in the original installation
• Process creation events showing cmd.exe, bash, curl, wget, or network tools spawned as children of the Java/Tomcat process running SD-WAN Manager
• Outbound connections from the SD-WAN Manager host to external IP addresses on non-standard ports, particularly those established by Java or unexpected processes
• SD-WAN Manager audit log entries for bulk configuration exports, new administrator account creation, or routing policy changes outside change windows
• AWS CloudTrail or Azure Monitor logs showing API calls using credentials associated with SD-WAN Manager — particularly DescribeInstances, ListBuckets, or IAM operations from unusual source IPs

index=web sourcetype=access_combined OR sourcetype=cisco_sdwan
  uri_path="/dataservice/*"
  (http_header="*alg\":\"none*" OR http_header="*alg\":\"None*"
   OR request_body="*alg\":\"none*" OR cookie="*alg\":\"none*")
| eval bypass_attempt="CVE-2026-20122 JWT alg:none"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as endpoints by src_ip bypass_attempt
| sort - count

index=web sourcetype=access_combined
  uri_path="/dataservice/disasterrecovery/download"
  (uri_query="*../*" OR uri_query="*%2e%2e%2f*" OR uri_query="*%252e%252e*")
| eval vuln="CVE-2026-20128 path traversal credential extraction"
| stats count by src_ip uri_query vuln

alert http any any -> $SDWAN_MGMT_SERVERS any (msg:"CVE-2026-20122 Cisco SD-WAN JWT alg:none Auth Bypass"; flow:established,to_server; content:"Authorization|3a 20|Bearer "; http_header; content:"alg"; within:200; content:"none"; within:30; nocase; sid:9002201; rev:1;)
alert http any any -> $SDWAN_MGMT_SERVERS any (msg:"CVE-2026-20128 Cisco SD-WAN Path Traversal Credential File Access"; flow:established,to_server; content:"/dataservice/disasterrecovery/download"; http_uri; pcre:"/fileName=(\.\.|%2e%2e|%252e%252e)/Ui"; http_uri; sid:9002202; rev:1;)
alert http any any -> $SDWAN_MGMT_SERVERS any (msg:"CVE-2026-20133 Cisco SD-WAN JWT Signing Key Disclosure"; flow:established,to_server; content:"/dataservice/client/server"; http_uri; content:"Authorization|3a 20|Bearer "; http_header; sid:9002203; rev:1;)

Timeline

References

• NVD — CVE-2026-20122
• CISA KEV — CVE-2026-20122
• Cisco Security Advisory — CVE-2026-20122