Known vulnerabilities in Catalyst SD-WAN Manager (formerly SD-WAN vManage)
Vendor:
Cisco Systems, Inc
Software CPE:
cpe:2.3:a:cisco_systems:cisco_sd-wan_vmanage:*:*:*:*:*:*:*:*
Website:
https://www.cisco.com
Total vulnerabilities:
110
Public exploits:
3
Known exploited (KEV):
8
Highest CVSSv4 Score:
10
Breakdown by Severity Chart
20.12.8.1
26.2.1
26.1.2
20.18.4
20.15.6
20.12.8
20.9.10
26.1.1.2
20.18.3.1
20.15.5.3
20.15.4.5
20.12.7.2
20.9.9.2
20.15.4.3
20.15.5.1
20.18.2.2
26.1.1
20.15.5
20.18.2.1
20.15.4.2
20.12.5.3
20.12.6.1
20.9.8.2
20.12.4
20.12.3
20.15.2
20.9.7
20.16.1
20.12.5
20.16
20.15
20.15.1
20.14
20.13
20.9.4.1
20.12.1
20.3.7
20.12
20.10.1
20.6.2
20.9.3.4
20.6.6
20.11.1.2
20.10.1.2
20.9.3.2
20.6.5.5
20.6.4.2
20.6.3.4
20.6.3.3
20.11.1
20.9.3
20.11
20.10
20.8.1
20.6.5
20.9.1
20.6.4
20.9
20.8
20.7.2
20.6.3
20.3
20.7
20.7.1
20.6
20.6.1
20.5.2
20.3.4
20.5
20.4
20.4.2
19.2.99
20.5.0
20.4.1.2
20.3.3.1
20.3.2.1
20.1.3
19.2.31
20.4.1.1
20.1.1.1
20.1.0.20.1.1
19.3.0
19.2.099
19.2.097
19.2.0
19.1.0
18.4.4
18.4.303
18.4.302
18.4.3
18.4.0.1
18.4.0
18.3.6.1
18.3.3.1
18.3.1.1
18.3.8
18.3.7
18.3.6
18.3.5
18.3.4
18.3.3
18.3.2
18.3.1
18.3.0
17.2.10
17.2.9
17.2.8
17.2.6
17.2.5
17.2.4
17.2.3
17.2.2
17.2.1
17.2.0
20.5.1
20.3.3
20.1.12
19.2.4
18.4.6
20.4.0
20.4.1
18.2.0
20.3.0
20.3.2
19.2.1
20.3.1
20.1.2
20.1
19.3
20.1.1
19.2.3
17.2.7
19.2
18.4
18.3
19.2.2
18.4.5
Vulnerabilities (110)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU141021 - Improper Link Resolution Before File Access ('Link Following') CVE-2026-20310 |
CWE-59 | Medium | 20.9.10, 20.12.8.1, 20.15.6, 20.18.4, 26.1.2 | 06.08.2026 |
SB2026080610 |
||
| #VU141022 - Cleartext Storage of Sensitive Information CVE-2026-20312 |
CWE-312 | Medium | 20.9.10, 20.12.8.1, 20.15.6, 20.18.4, 26.1.2 | 06.08.2026 |
SB2026080610 |
||
| #VU141023 - Improper Validation of Specified Quantity in Input CVE-2026-20313 |
CWE-1284 | Medium | 20.9.10, 20.12.8.1, 20.15.6, 20.18.4, 26.1.2 | 06.08.2026 |
SB2026080610 |
||
| #VU141019 - Improper input validation CVE-2026-20303 |
CWE-20 | Medium | 20.9.10, 20.12.8.1, 20.15.6, 20.18.4, 26.1.2 | 06.08.2026 |
SB2026080610 |
||
| #VU141020 - Improper Access Control CVE-2026-20304 |
CWE-284 | Medium | 20.9.10, 20.12.8.1, 20.15.6, 20.18.4, 26.1.2 | 06.08.2026 |
SB2026080610 |
||
| #VU141010 - Cleartext Transmission of Sensitive Information CVE-2026-20294 |
CWE-319 | Low | 20.9.10, 20.12.8, 20.15.6, 20.18.4, 26.1.2, 26.2.1 | 05.08.2026 |
SB2026080554 |
||
| #VU134581 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2026-20262 |
CWE-22 | High | 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, 26.1.1.2 | 16.06.2026 |
SB2026061606 |
||
| #VU133402 - Improper Encoding or Escaping of Output CVE-2026-20245 |
CWE-116 | High | 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, 26.1.1.2 | 05.06.2026 |
SB2026060506 |
||
| #VU131451 - Improper Restriction of XML External Entity Reference ('XXE') CVE-2026-20224 |
CWE-611 | High | 20.15.4.3, 20.15.5.1, 20.18.2.2, 26.1.1 | 14.05.2026 |
SB20260514105 |
||
| #VU131452 - Information Exposure Through Log Files CVE-2026-20209 |
CWE-532 | Low | 20.15.4.3, 20.15.5.1, 20.18.2.2, 26.1.1 | 14.05.2026 |
SB20260514105 |
||
| #VU131453 - Exposure of sensitive information to an unauthorized actor CVE-2026-20210 |
CWE-200 | Low | 20.15.4.3, 20.15.5.1, 20.18.2.2, 26.1.1 | 14.05.2026 |
SB20260514105 |
||
| #VU131450 - Improper Authentication CVE-2026-20182 |
CWE-287 | Critical | 20.15.4.3, 20.15.5.1, 20.18.2.2, 26.1.1 | 14.05.2026 |
SB20260514104 |
||
| #VU124592 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2026-20108 |
CWE-79 | Low | 20.12.5.3, 20.12.6.1, 20.15.4.2, 20.15.5, 20.18.2.1 | 25.03.2026 |
SB20260325181 |
||
| #VU123273 - Improper Authentication CVE-2026-20127 |
CWE-287 | Critical | 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.15.4.2, 20.18.2.1 | 25.02.2026 |
SB2026022553 |
||
| #VU123272 - Unrestricted Upload of File with Dangerous Type CVE-2026-20122 |
CWE-434 | Medium | 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.15.4.2, 20.18.2.1 | 25.02.2026 |
SB2026022552 |
||
| #VU123271 - Improper Access Control CVE-2026-20133 |
CWE-284 | Medium | 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.15.4.2, 20.18.2.1 | 25.02.2026 |
SB2026022552 |
||
| #VU123270 - Unprotected Storage of Credentials CVE-2026-20128 |
CWE-256 | Low | 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.15.4.2 | 25.02.2026 |
SB2026022552 |
||
| #VU123269 - Improper Authorization CVE-2026-20126 |
CWE-285 | Low | 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.15.4.2, 20.18.2.1 | 25.02.2026 |
SB2026022552 |
||
| #VU123268 - Improper Authentication CVE-2026-20129 |
CWE-287 | Critical | 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.15.4.2 | 25.02.2026 |
SB2026022552 |
||
| #VU109194 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2025-20187 |
CWE-22 | Medium | 20.9.7, 20.15.2 | 15.05.2025 |
SB2025051505 |
Showing elements 1 - 20 out of 110