Yes. CISA added CVE-2026-20128 to its Known Exploited Vulnerabilities catalogue on 20 April 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.
What this CVE means operationally for exposure checks
The practical question is not just whether exploitation is happening, but whether your environment contains Cisco Catalyst SD-WAN Manager systems that can still expose the recoverable-password condition. Because the flaw is tied to an authenticated, local attacker and access to a credential file on the filesystem, exposure checks should focus on who can reach the manager host, what local privileges exist, and whether credential material is stored where a low-privileged account can read it. For a broader response pattern on active exploitation, see Zero-Day and Exploited Vulnerabilities Guide.
Confirmation should also include whether the product is being monitored as part of your vulnerability inventory and whether the instance has already been flagged in the CISA Known Exploited Vulnerabilities Catalog. KEV listing is an operational signal that the issue should be treated as a live risk, not a theoretical weakness, even before you determine whether your specific host has been touched.
Why recoverable passwords create a real compromise path
A recoverable password issue changes the problem from simple configuration weakness to possible privilege escalation. If a low-privileged user can read a filesystem credential file and derive the DCA user password, the attacker may be able to move from local foothold to administrative or service-level access that was not intended for that account. That kind of access path is exactly what makes stored secrets dangerous, because the security boundary is no longer the login screen, but the filesystem object and its local permissions.
This matters because once credentials are recoverable, any attacker who gains even limited local access can potentially reuse them elsewhere in the management plane. For teams that want a general control baseline around password storage, rotation, and reuse risks, the Password Security and Password Manager Guide is a useful companion. The issue is not just password strength, it is whether the secret can be recovered at all from the host.
What to do if patching must wait
If you cannot remediate immediately, the safest interim approach is to shrink local access as aggressively as possible and treat the credential file as exposed material. Restrict shell access, review which administrators and service accounts can log on to the manager host, and remove any unnecessary local privilege that would let a standard user inspect files on disk. If the system has to remain online, reduce the blast radius of any recovered password by limiting where that account can authenticate and what it can do.
At the same time, use the situation as a trigger to review whether the system has broader credential exposure patterns. NHIMG’s The State of NHI & AI Agent Breach Report 2026 is useful context for how often credential theft, secrets exposure, and privilege abuse show up together in real incidents. The lesson for this CVE is that local recoverability often becomes an authentication problem somewhere else in the environment.
Risk and Threat Considerations
When a vulnerability exposes recoverable credentials, the main risk is not only initial compromise, but reuse. An attacker who obtains the DCA user password may be able to authenticate later as a trusted account, blend into normal administration, and bypass controls that assume the password was never discoverable from disk. That can turn a local weakness into broader management-plane access or lateral movement.
Failure mechanism: A low-privileged local user reaches a credential file, derives the stored password, and then uses that password to gain higher-privilege access or access adjacent systems that trust the same account.
Impact: The attacker may obtain unauthorized control of the SD-WAN management environment, expand access beyond the original host, and create persistence through a legitimate-looking account rather than noisy malware.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack surface, NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication, and Access Control | Recoverable credentials directly affect access control and authentication assurance. |
| Recommendation — Restrict and monitor privileged access paths that can reach sensitive credential files. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The issue is about stored passwords and their lifecycle, including rotation and protection. |
| Recommendation — Manage stored authenticators so they cannot be recovered from local files. | ||
| CIS Controls v8 | CIS-5 — Account Management | Recovered passwords can be abused through weak account lifecycle and local access governance. |
| Recommendation — Review and restrict accounts that can access management hosts and sensitive credentials. | ||
| ISO/IEC 27001:2022 | A.8.24 — Use of cryptography | Secret recovery concerns whether stored credential material is adequately protected at rest. |
| Recommendation — Protect stored credentials so they are not recoverable from the filesystem. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The flaw exposes password material through recoverable storage, a direct secret leakage condition. |
| Recommendation — Eliminate recoverable secret storage and rotate any credential that may have been exposed. | ||
Practitioner Guidance
What to verify: Confirm whether the affected host has any non-administrative local users, shared admin access, or automation accounts that can read the filesystem location containing the credential file. If you cannot prove the file is unreadable to low-privileged users, treat the password as potentially exposed.
Decision rule: If the DCA password could have been recovered, rotate it and any dependent credentials before you spend time proving exploitation, because the credential itself is the durable risk. If you also find suspicious local access or unexpected logins, escalate to compromise assessment and session review.
Practitioner takeaway: For recoverable-password CVEs, exposure management is inseparable from credential hygiene, the safest assumption is that any readable secret may already be usable elsewhere.
Related resources from NHI Mgmt Group
- CVE-2026-20128 (Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format)
- CVE-2026-20133 (Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor)
- CVE-2026-20127 (Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass)
- CVE-2026-20122 (Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs)