CVE-2026-20122

KEV の『悪用』には未遂(脆弱でない環境やハニーポットでの試行)が含まれ、特定の組織が侵害されたことを意味しない。

KEV の登録内容

vulnerabilityName: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability
vendorProject: Cisco
product: Catalyst SD-WAN Manger
dateAdded: 2026-04-20
shortDescription: Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.
requiredAction: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
dueDate: 2026-04-23
knownRansomwareCampaignUse: Unknown
forensicTriage: No
notes: CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v ; https://nvd.nist.gov/vuln/detail/CVE-2026-20122
cwes: CWE-648

初めて観測: 2026-10-02T21:06:48Z / 最後に観測: 2026-10-02T21:06:48Z(last_observed_at。値の変更を最後に確認した時刻)

観測した変更

取り込み開始以降、KEV の値の変更は観測していません。

CVE レコード(CVE Program)

state: PUBLISHED
datePublished: 2026-02-25T16:14:21.256Z
dateUpdated: 2026-04-21T03:55:33.255Z

CNA の affected

Cisco Cisco Catalyst SD-WAN Manager (20.1.12; 19.2.1; 18.4.4; 18.4.5; 20.1.1.1; 20.1.1; 19.3.0; 19.2.2; 19.2.099; 18.3.6; 18.3.7; 19.2.0; 18.3.8; 19.0.0; 19.1.0; 18.4.302; 18.4.303; 19.2.097; 19.2.098; 17.2.10; 18.3.6.1; 19.0.1a; 18.2.0; 18.4.3; 18.4.1; 17.2.8; 18.3.3.1; 18.4.0; 18.3.1; 17.2.6; 17.2.9; 18.3.4; 17.2.5; 18.3.1.1; 18.3.5; 18.4.0.1; 18.3.3; 17.2.7; 17.2.4; 18.3.0; 19.2.3; 18.4.501_ES; 20.3.1; 20.1.2; 19.2.929; 19.2.31; 20.3.2; 19.2.32; 20.3.2_925; 20.3.2.1; 20.3.2.1_927; 18.4.6; 20.1.2_937; 20.4.1; 20.3.2_928; 20.3.2_929; 20.4.1.0.1; 20.3.2.1_930; 19.2.4; 20.5.0.1.1; 20.4.1.1; 20.3.3; 19.2.4.0.1; 20.3.2_937; 20.3.3.1; 20.5.1; 20.1.3; 20.3.3.0.4; 20.3.3.1.2; 20.3.3.1.1; 20.4.1.2; 20.3.3.0.2; 20.4.1.1.5; 20.4.1.0.01; 20.4.1.0.02; 20.3.3.1.7; 20.3.3.1.5; 20.5.1.0.1; 20.3.3.1.10; 20.3.3.0.8; 20.4.2; 20.4.2.0.1; 20.3.4; 20.3.3.0.14; 19.2.4.0.8; 19.2.4.0.9; 20.3.4.0.1; 20.3.2.0.5; 20.6.1; 20.5.1.0.2; 20.3.3.0.17; 20.6.1.1; 20.6.0.18.3; 20.3.2.0.6; 20.6.0.18.4; 20.4.2.0.2; 20.3.3.0.16; 20.3.4.0.5; 20.6.1.0.1; 20.3.4.0.6; 20.6.2; 20.7.1EFT2; 20.3.4.0.9; 20.3.4.0.11; 20.4.2.0.4; 20.3.3.0.18; 20.7.1; 20.6.2.1; 20.3.4.1; 20.5.1.1; 20.4.2.1; 20.4.2.1.1; 20.3.4.1.1; 20.3.813; 20.3.4.0.19; 20.4.2.2.1; 20.5.1.2; 20.3.4.2; 20.3.814; 20.4.2.2; 20.6.2.2; 20.3.4.2.1; 20.7.1.1; 20.3.4.1.2; 20.6.2.2.2; 20.3.4.0.20; 20.6.2.2.3; 20.4.2.2.2; 20.3.5; 20.6.2.0.4; 20.4.2.2.3; 20.3.4.0.24; 20.6.2.2.7; 20.6.3; 20.3.4.2.2; 20.4.2.2.4; 20.7.1.0.2; 20.8.1; 20.3.5.0.8; 20.3.5.0.9; 20.4.2.2.8; 20.3.5.0.7; 20.6.3.0.7; 20.6.3.0.5; 20.6.3.0.10; 20.6.3.0.2; 20.7.2; 20.9.1EFT2; 20.6.3.0.11; 20.6.3.1; 20.6.3.0.14; 20.6.4; 20.9.1; 20.6.3.0.19; 20.6.3.0.18; 20.3.6; 20.9.1.1; 20.6.3.0.23; 20.6.4.0.4; 20.6.3.0.25; 20.6.5; 20.6.3.0.27; 20.9.2; 20.9.2.1; 20.6.3.0.29; 20.6.3.0.31; 20.6.3.0.32; 20.10.1; 20.6.3.0.33; 20.9.2.0.01; 20.9.1_LI_Images; 20.10.1_LI_Images; 20.9.2_LI_Images; 20.3.7; 20.9.3; 20.6.5.1; 20.11.1; 20.11.1_LI_Images; 20.9.3_LI_ Images; 20.6.3.1.1; 20.9.3.0.2; 20.6.5.1.2; 20.9.3.0.3; 20.4.2.3; 20.6.3.2; 20.6.4.1; 20.6.3.0.38; 20.6.3.0.39; 20.3.5.1; 20.3.4.3; 20.9.3.1; 20.3.3.2; 20.6.5.2; 20.3.7.1; 20.10.1.1; 20.6.5.2.1; 20.3.4.0.25; 20.6.2.2.4; 20.6.1.2; 20.11.1.1; 20.9.3.0.5; 20.3.4.0.26; 20.6.5.1.3; 20.6.3.0.40; 20.1.3.1; 20.9.2.2; 20.6.5.2.3; 20.6.5.1.4; 20.6.5.3; 20.6.3.0.41; 20.9.3.0.7; 20.6.5.1.5; 20.9.3.0.4; 20.6.4.0.19; 20.6.5.1.6; 20.9.3.0.8; 20.6.3.3; 20.3.7.2; 20.6.5.4; 20.6.5.1.7; 20.9.3.0.12; 20.6.4.2; 20.6.5.5; 20.9.3.2; 20.11.1.2; 20.6.3.4; 20.10.1.2; 20.6.5.1.9; 20.9.3.0.16; 20.6.3.0.45; 20.6.5.1.10; 20.9.3.0.17; 20.6.5.2.4; 20.6.4.0.21; 20.9.3.0.18; 20.6.3.0.46; 20.6.3.0.47; 20.9.2.3; 20.9.3.2_LI_Images; 20.9.3.0.21; 20.9.3.0.20; 20.9.4_LI_Images; 20.9.4; 20.6.5.1.11; 20.12.1; 20.12.1_LI_Images; 20.6.5.1.13; 20.9.3.0.23; 20.6.5.2.8; 20.9.4.1; 20.9.4.1_LI_Images; 20.9.3.0.25; 20.9.3.0.24; 20.6.5.1.14; 20.3.8; 20.6.6; 20.9.3.0.26; 20.6.3.0.51; 20.9.3.0.29; 20.12.2; 20.12.2_LI_Images; 20.6.6.0.1; 20.13.1_LI_Images; 20.9.4.0.4; 20.13.1; 20.9.4.1.1; 20.9.5; 20.9.5_LI_Images; 20.12.3_LI_Images; 20.12.3; 20.9.4.1.3; 20.6.7; 20.9.5.1; 20.9.5.1_LI_Images; 20.9.4.1.6; 20.14.1; 20.14.1_LI_Images; 20.9.5.2; 20.9.5.2.1; 20.9.5.2_LI_Images; 20.12.3.1; 20.12.4; 20.15.1_LI_Images; 20.15.1; 20.9.5.1.4; 20.9.5.2.7; 20.9.5.2.13; 20.9.6; 20.9.6_LI_Images; 20.9.5.2.14; 20.6.8; 20.12.4.0.03; 20.16.1; 20.16.1_LI_Images; 20.12.4_LI_Images; 20.9.5.2.16; 20.12.4.0.4; 20.12.401; 20.9.5.3; 20.9.5.3_LI_Images; 20.12.4.1_LI_Images; 20.12.4.1; 20.9.5.2.21; 20.9.6.0.3; 20.12.4.0.6; 20.15.2_LI_Images; 20.15.2; 20.12.4_Monthly_ES5; 20.12.5; 20.12.5_LI_Images; 20.9.7_LI _Images; 20.9.7; 20.15.3; 20.15.3_ LI _Images; 20.12.501; 20.12.5.1_LI_Images; 20.12.5.1; 20.12.5.2_LI_Images; 20.12.5.2; 20.15.3.1; 20.15.4_LI_Images; 20.15.4; 20.9.7.1_LI _Images; 20.9.7.1; 20.18.1; 20.18.1_LI_Images; 20.12.6_LI_Images; 20.12.6; 20.12.5.1.01; 20.9.8; 20.9.8_LI_Images; 20.18.2; 20.15.4.1_LI_Images; 20.15.4.1; 20.18.2_LI_Images)

KEV と CNA で製品の表記が異なる。KEV の vendorProject・product と CNA の affected が、大文字小文字を無視した包含で一致しなかった(機械的な照合で、どちらが正しいかは判定していない)。

外部のページ

出典: CISA Known Exploited Vulnerabilities Catalog(CISA KEV。CC0 1.0)。詳しくは出典表記とライセンス。

出典: CVE Program(CVE レコード)。詳しくは出典表記とライセンス。

Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

脆弱性の一覧へ