According to its self-reported version, Cisco SD-WAN Viptela Software is affected by multiple vulnerabilities.

  - A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an     unauthenticated, remote attacker to read arbitrary files that are stored in an affected system. The     attacker does not need to have valid user credentials. This vulnerability is due to improper handling of     XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability     by sending a crafted request to an affected system. A successful exploit could allow the attacker to read     arbitrary files that are stored in the affected system. (CVE-2026-20224)

  - A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an     authenticated, remote attacker with read-only permissions to elevate their privileges from low to high and     perform actions as a high-privileged user. This vulnerability exists because sensitive session information     is recorded in audit logs. An attacker could exploit this vulnerability by elevating their read-only     permissions in Cisco Catalyst SD-WAN Manager to those of a high-privileged user. A successful exploit     could allow the attacker to perform actions as a high-privileged user. (CVE-2026-20209)

  - A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an     authenticated, remote attacker with read-only permissions to modify configurations and perform     unauthorized actions on an affected system. This vulnerability exists because of a failure to redact     sensitive information within device configurations and templates. An attacker could exploit this     vulnerability by elevating their read-only permissions to those of a high-privileged user. A successful     exploit could allow the attacker to access or modify configuration settings within Cisco Catalyst SD-WAN     Manager as a high-privileged user. (CVE-2026-20210)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Detections

Analytics

Cisco Catalyst SD-WAN Manager Vulnerabilities (cisco-sa-sdwan-mltvnps2-JxpWm7R)

high Nessus Plugin ID 315344

Version 1.4

Version 1.3

Version 1.1

Version 1.4 Sep 22, 2026, 1:29 PM Detection (Added check for non-vulnerable device.) Plugin Feed: 202609221329
Version 1.3 Jul 8, 2026, 6:25 PM Logic Changes (avoid fp) Plugin Feed: 202607081825
Version 1.1 May 20, 2026, 3:58 PM New Plugin Feed: 202605201558