[KEV] CVE-2026-20133 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2026-20133 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2026-20133 is an information disclosure vulnerability in Cisco Catalyst SD-WAN Manager that allows remote, unauthenticated attackers to access sensitive information on affected systems.

Technical Detail

The flaw is classified as an exposure of sensitive information to an unauthorized actor, meaning the system improperly permits access to protected data without requiring valid credentials or authorization. A remote attacker can trigger this condition by sending crafted requests to the SD-WAN Manager interface, potentially retrieving configuration data, credentials, or other sensitive operational details. The direct impact is unauthorized information disclosure, which can serve as a stepping stone for further compromise of the SD-WAN infrastructure or connected network segments.

Exploitation Status

CISA has confirmed active exploitation in the wild, having added this vulnerability to the Known Exploited Vulnerabilities catalog on April 20, 2026. The exploit maturity is rated Operational, meaning functional exploit code exists and is being used in real-world attacks, not merely demonstrated in a controlled research context. Organizations should treat this as an actively targeted vulnerability requiring immediate attention.

Who Is Targeting This

No specific threat actor attribution has been confirmed at this time. No campaigns, targeted sectors, or named groups have been formally linked to exploitation of this vulnerability in available reporting. Given the nature of the affected product, network-focused threat actors and espionage-oriented groups historically targeting enterprise networking infrastructure represent a plausible risk profile, but this is not confirmed attribution.

What To Do

Per CISA's Known Exploited Vulnerabilities catalog, federal agencies are required to apply vendor-supplied patches or implement mitigations by the deadline associated with the April 20, 2026 listing. All organizations running Cisco Catalyst SD-WAN Manager should apply the relevant Cisco security updates immediately and treat this as a priority patch given confirmed active exploitation. If patching cannot be completed immediately, restrict external access to the SD-WAN Manager interface and limit exposure to trusted management networks only. Review Cisco's official security advisory for specific fixed software versions and any available workarounds. Audit logs for anomalous access attempts or unexpected data retrieval activity against the SD-WAN Manager interface as a detection measure.