CVE-2026-20133

KEV の『悪用』には未遂(脆弱でない環境やハニーポットでの試行)が含まれ、特定の組織が侵害されたことを意味しない。

KEV の登録内容

vulnerabilityName: Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
vendorProject: Cisco
product: Catalyst SD-WAN Manager
dateAdded: 2026-04-20
shortDescription: Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.
requiredAction: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
dueDate: 2026-04-23
knownRansomwareCampaignUse: Unknown
forensicTriage: No
notes: CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v ; https://nvd.nist.gov/vuln/detail/CVE-2026-20133
cwes: CWE-200

初めて観測: 2026-10-02T21:06:48Z / 最後に観測: 2026-10-02T21:06:48Z(last_observed_at。値の変更を最後に確認した時刻)

観測した変更

取り込み開始以降、KEV の値の変更は観測していません。

CVE レコード(CVE Program)

state: PUBLISHED
datePublished: 2026-02-25T16:13:56.017Z
dateUpdated: 2026-04-22T15:31:56.704Z

CNA の affected

Cisco Cisco Catalyst SD-WAN Manager (17.2.6; 17.2.7; 17.2.8; 17.2.9; 17.2.10; 17.2.4; 17.2.5; 18.3.1.1; 18.3.3.1; 18.3.3; 18.3.4; 18.3.5; 18.3.7; 18.3.8; 18.3.6.1; 18.3.1; 18.3.0; 18.4.0.1; 18.4.3; 18.4.302; 18.4.303; 18.4.4; 18.4.5; 18.4.0; 18.4.1; 18.4.6; 19.2.0; 19.2.097; 19.2.099; 19.2.1; 19.2.2; 19.2.3; 19.2.31; 19.2.929; 19.2.4; 20.1.1.1; 20.1.12; 20.1.1; 20.1.2; 20.1.3; 19.3.0; 19.1.0; 18.2.0; 20.3.1; 20.3.2; 20.3.2.1; 20.3.3; 20.3.3.1; 20.3.4; 20.3.4.1; 20.3.4.2; 20.3.5; 20.3.6; 20.3.7; 20.3.7.1; 20.3.4.3; 20.3.5.1; 20.3.7.2; 20.3.8; 20.4.1; 20.4.1.1; 20.4.1.2; 20.4.2; 20.4.2.2; 20.4.2.1; 20.4.2.3; 20.5.1; 20.5.1.2; 20.5.1.1; 20.6.1; 20.6.1.1; 20.6.2.1; 20.6.2.2; 20.6.2; 20.6.3; 20.6.3.1; 20.6.4; 20.6.5; 20.6.5.1; 20.6.5.3; 20.6.1.2; 20.6.3.2; 20.6.4.1; 20.6.5.2; 20.6.5.4; 20.6.3.3; 20.6.4.2; 20.6.3.0.45; 20.6.3.0.46; 20.6.3.0.47; 20.6.3.4; 20.6.4.0.21; 20.6.5.1.10; 20.6.5.1.11; 20.6.5.1.7; 20.6.5.1.9; 20.6.5.2.4; 20.6.5.5; 20.6.5.2.8; 20.6.5.1.13; 20.6.6; 20.6.7; 20.6.8; 20.7.1; 20.7.1.1; 20.7.2; 20.8.1; 20.9.1; 20.9.2; 20.9.2.1; 20.9.3; 20.9.3.1; 20.9.2.3; 20.9.3.0.12; 20.9.3.0.16; 20.9.3.0.17; 20.9.3.0.18; 20.9.3.0.20; 20.9.3.0.21; 20.9.3.2; 20.9.3.2_LI_Images; 20.9.4; 20.9.4_LI_Images; 20.9.3.0.23; 20.9.4.1; 20.9.5; 20.9.5.1; 20.9.5.2; 20.9.6; 20.9.5.3; 20.9.7; 20.9.7.1; 20.9.8; 20.10.1; 20.10.1.1; 20.10.1.2; 20.11.1; 20.11.1.1; 20.11.1.2; 20.12.1; 20.12.1_LI_Images; 20.12.2; 20.12.3; 20.12.3.1; 20.12.4; 20.12.4.1; 20.12.5; 20.12.5.1; 20.12.5.2; 20.12.6; 20.13.1; 20.14.1; 20.15.1; 20.15.2; 20.15.3; 20.15.3.1; 20.15.4; 20.15.4.1; 20.16.1; 20.18.1; 20.18.2)

外部のページ

出典: CISA Known Exploited Vulnerabilities Catalog(CISA KEV。CC0 1.0)。詳しくは出典表記とライセンス。

出典: CVE Program(CVE レコード)。詳しくは出典表記とライセンス。

Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

脆弱性の一覧へ