Cisco Catayst SD-WAN 認証バイパスの脆弱性

The impact of CVE-2026-20129 is severe. An attacker exploiting this vulnerability can effectively impersonate a netadmin user, granting them full administrative control over the affected Cisco Catalyst SD-WAN Manager instance. This includes the ability to modify configurations, access sensitive data, and potentially disrupt network operations. The lack of authentication required for exploitation significantly lowers the barrier to entry for attackers, increasing the likelihood of exploitation. The ability to execute commands with netadmin privileges provides a broad attack surface, allowing for extensive compromise of the system and potentially the wider network it manages. This vulnerability shares similarities with other API authentication bypasses where improper validation allows unauthorized access.

Organizations heavily reliant on Cisco Catalyst SD-WAN Manager for network management and routing are particularly at risk. Environments with exposed APIs or weak network segmentation are also more vulnerable. Those using older, unpatched versions of the software (≤20.18.2LIImages) are directly affected and should prioritize patching.

• linux / server:

journalctl -u cisco-sdwan-manager -g "authentication bypass"

• generic web:

curl -I <sdwan_manager_api_endpoint> -H 'Authorization:' | grep -q '200 OK'

• cisco / network:

show running-config | include api-user

1. 2026-02-25Disclosure

   disclosure

1. 予約済み2025-10-08
2. 公開日2026-02-25
3. 更新日2026-03-20
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-20129 is to upgrade Cisco Catalyst SD-WAN Manager to version 20.18 or later. If immediate upgrade is not feasible, consider implementing strict network segmentation to limit external access to the SD-WAN Manager API. Review and restrict API access controls, ensuring only authorized users and systems can interact with the API. While a WAF or proxy cannot directly prevent the authentication bypass, it can be configured to monitor for suspicious API requests and potentially block them based on known attack patterns. Monitor API logs for unusual activity or unauthorized access attempts. After upgrading, verify the fix by attempting to access the API without proper authentication and confirming that access is denied.