CVE-2026-20224 PUBLISHED

Cisco Catalyst SD-WAN Manager XML External Entity Injection Vulnerability

Assigner: cisco
Reserved: 08.10.2025 Published: 14.05.2026 Updated: 14.05.2026

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to read arbitrary files that are stored in an affected system. The attacker does not need to have valid user credentials.

This vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to read arbitrary files that are stored in the affected system.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS Score: 8.6

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Cisco
Product	Cisco Catalyst SD-WAN Manager
Versions	Default: unknown Version 20.1.12 is affected Version 19.2.1 is affected Version 18.4.4 is affected Version 18.4.5 is affected Version 20.1.1.1 is affected Version 20.1.1 is affected Version 19.3.0 is affected Version 19.2.2 is affected Version 19.2.099 is affected Version 18.3.6 is affected Version 18.3.7 is affected Version 19.2.0 is affected Version 18.3.8 is affected Version 19.0.0 is affected Version 19.1.0 is affected Version 18.4.302 is affected Version 18.4.303 is affected Version 19.2.097 is affected Version 19.2.098 is affected Version 17.2.10 is affected Version 18.3.6.1 is affected Version 19.0.1a is affected Version 18.2.0 is affected Version 18.4.3 is affected Version 18.4.1 is affected Version 17.2.8 is affected Version 18.3.3.1 is affected Version 18.4.0 is affected Version 18.3.1 is affected Version 17.2.6 is affected Version 17.2.9 is affected Version 18.3.4 is affected Version 17.2.5 is affected Version 18.3.1.1 is affected Version 18.3.5 is affected Version 18.4.0.1 is affected Version 18.3.3 is affected Version 17.2.7 is affected Version 17.2.4 is affected Version 18.3.0 is affected Version 19.2.3 is affected Version 18.4.501_ES is affected Version 20.3.1 is affected Version 20.1.2 is affected Version 19.2.929 is affected Version 19.2.31 is affected Version 20.3.2 is affected Version 19.2.32 is affected Version 20.3.2_925 is affected Version 20.3.2.1 is affected Version 20.3.2.1_927 is affected Version 18.4.6 is affected Version 20.1.2_937 is affected Version 20.4.1 is affected Version 20.3.2_928 is affected Version 20.3.2_929 is affected Version 20.4.1.0.1 is affected Version 20.3.2.1_930 is affected Version 19.2.4 is affected Version 20.5.0.1.1 is affected Version 20.4.1.1 is affected Version 20.3.3 is affected Version 19.2.4.0.1 is affected Version 20.3.2_937 is affected Version 20.3.3.1 is affected Version 20.5.1 is affected Version 20.1.3 is affected Version 20.3.3.0.4 is affected Version 20.3.3.1.2 is affected Version 20.3.3.1.1 is affected Version 20.4.1.2 is affected Version 20.3.3.0.2 is affected Version 20.4.1.1.5 is affected Version 20.4.1.0.01 is affected Version 20.4.1.0.02 is affected Version 20.3.3.1.7 is affected Version 20.3.3.1.5 is affected Version 20.5.1.0.1 is affected Version 20.3.3.1.10 is affected Version 20.3.3.0.8 is affected Version 20.4.2 is affected Version 20.4.2.0.1 is affected Version 20.3.4 is affected Version 20.3.3.0.14 is affected Version 19.2.4.0.8 is affected Version 19.2.4.0.9 is affected Version 20.3.4.0.1 is affected Version 20.3.2.0.5 is affected Version 20.6.1 is affected Version 20.5.1.0.2 is affected Version 20.3.3.0.17 is affected Version 20.6.1.1 is affected Version 20.6.0.18.3 is affected Version 20.3.2.0.6 is affected Version 20.6.0.18.4 is affected Version 20.4.2.0.2 is affected Version 20.3.3.0.16 is affected Version 20.3.4.0.5 is affected Version 20.6.1.0.1 is affected Version 20.3.4.0.6 is affected Version 20.6.2 is affected Version 20.7.1EFT2 is affected Version 20.3.4.0.9 is affected Version 20.3.4.0.11 is affected Version 20.4.2.0.4 is affected Version 20.3.3.0.18 is affected Version 20.7.1 is affected Version 20.6.2.1 is affected Version 20.3.4.1 is affected Version 20.5.1.1 is affected Version 20.4.2.1 is affected Version 20.4.2.1.1 is affected Version 20.3.4.1.1 is affected Version 20.3.813 is affected Version 20.3.4.0.19 is affected Version 20.4.2.2.1 is affected Version 20.5.1.2 is affected Version 20.3.4.2 is affected Version 20.3.814 is affected Version 20.4.2.2 is affected Version 20.6.2.2 is affected Version 20.3.4.2.1 is affected Version 20.7.1.1 is affected Version 20.3.4.1.2 is affected Version 20.6.2.2.2 is affected Version 20.3.4.0.20 is affected Version 20.6.2.2.3 is affected Version 20.4.2.2.2 is affected Version 20.3.5 is affected Version 20.6.2.0.4 is affected Version 20.4.2.2.3 is affected Version 20.3.4.0.24 is affected Version 20.6.2.2.7 is affected Version 20.6.3 is affected Version 20.3.4.2.2 is affected Version 20.4.2.2.4 is affected Version 20.7.1.0.2 is affected Version 20.8.1 is affected Version 20.3.5.0.8 is affected Version 20.3.5.0.9 is affected Version 20.4.2.2.8 is affected Version 20.3.5.0.7 is affected Version 20.6.3.0.7 is affected Version 20.6.3.0.5 is affected Version 20.6.3.0.10 is affected Version 20.6.3.0.2 is affected Version 20.7.2 is affected Version 20.9.1EFT2 is affected Version 20.6.3.0.11 is affected Version 20.6.3.1 is affected Version 20.6.3.0.14 is affected Version 20.6.4 is affected Version 20.9.1 is affected Version 20.6.3.0.19 is affected Version 20.6.3.0.18 is affected Version 20.3.6 is affected Version 20.9.1.1 is affected Version 20.6.3.0.23 is affected Version 20.6.4.0.4 is affected Version 20.6.3.0.25 is affected Version 20.6.5 is affected Version 20.6.3.0.27 is affected Version 20.9.2 is affected Version 20.9.2.1 is affected Version 20.6.3.0.29 is affected Version 20.6.3.0.31 is affected Version 20.6.3.0.32 is affected Version 20.10.1 is affected Version 20.6.3.0.33 is affected Version 20.9.2.0.01 is affected Version 20.9.1_LI_Images is affected Version 20.10.1_LI_Images is affected Version 20.9.2_LI_Images is affected Version 20.3.7 is affected Version 20.9.3 is affected Version 20.6.5.1 is affected Version 20.11.1 is affected Version 20.11.1_LI_Images is affected Version 20.9.3_LI_ Images is affected Version 20.6.3.1.1 is affected Version 20.9.3.0.2 is affected Version 20.6.5.1.2 is affected Version 20.9.3.0.3 is affected Version 20.4.2.3 is affected Version 20.6.3.2 is affected Version 20.6.4.1 is affected Version 20.6.3.0.38 is affected Version 20.6.3.0.39 is affected Version 20.3.5.1 is affected Version 20.3.4.3 is affected Version 20.9.3.1 is affected Version 20.3.3.2 is affected Version 20.6.5.2 is affected Version 20.3.7.1 is affected Version 20.10.1.1 is affected Version 20.6.5.2.1 is affected Version 20.3.4.0.25 is affected Version 20.6.2.2.4 is affected Version 20.6.1.2 is affected Version 20.11.1.1 is affected Version 20.9.3.0.5 is affected Version 20.3.4.0.26 is affected Version 20.6.5.1.3 is affected Version 20.6.3.0.40 is affected Version 20.1.3.1 is affected Version 20.9.2.2 is affected Version 20.6.5.2.3 is affected Version 20.6.5.1.4 is affected Version 20.6.5.3 is affected Version 20.6.3.0.41 is affected Version 20.9.3.0.7 is affected Version 20.6.5.1.5 is affected Version 20.9.3.0.4 is affected Version 20.6.4.0.19 is affected Version 20.6.5.1.6 is affected Version 20.9.3.0.8 is affected Version 20.6.3.3 is affected Version 20.3.7.2 is affected Version 20.6.5.4 is affected Version 20.6.5.1.7 is affected Version 20.9.3.0.12 is affected Version 20.6.4.2 is affected Version 20.6.5.5 is affected Version 20.9.3.2 is affected Version 20.11.1.2 is affected Version 20.6.3.4 is affected Version 20.10.1.2 is affected Version 20.6.5.1.9 is affected Version 20.9.3.0.16 is affected Version 20.6.3.0.45 is affected Version 20.6.5.1.10 is affected Version 20.9.3.0.17 is affected Version 20.6.5.2.4 is affected Version 20.6.4.0.21 is affected Version 20.9.3.0.18 is affected Version 20.6.3.0.46 is affected Version 20.6.3.0.47 is affected Version 20.9.2.3 is affected Version 20.9.3.2_LI_Images is affected Version 20.9.3.0.21 is affected Version 20.9.3.0.20 is affected Version 20.9.4_LI_Images is affected Version 20.9.4 is affected Version 20.6.5.1.11 is affected Version 20.12.1 is affected Version 20.12.1_LI_Images is affected Version 20.6.5.1.13 is affected Version 20.9.3.0.23 is affected Version 20.6.5.2.8 is affected Version 20.9.4.1 is affected Version 20.9.4.1_LI_Images is affected Version 20.9.3.0.25 is affected Version 20.9.3.0.24 is affected Version 20.6.5.1.14 is affected Version 20.3.8 is affected Version 20.6.6 is affected Version 20.9.3.0.26 is affected Version 20.6.3.0.51 is affected Version 20.9.3.0.29 is affected Version 20.12.2 is affected Version 20.12.2_LI_Images is affected Version 20.6.6.0.1 is affected Version 20.13.1_LI_Images is affected Version 20.9.4.0.4 is affected Version 20.13.1 is affected Version 20.9.4.1.1 is affected Version 20.9.5 is affected Version 20.9.5_LI_Images is affected Version 20.12.3_LI_Images is affected Version 20.12.3 is affected Version 20.9.4.1.3 is affected Version 20.6.7 is affected Version 20.9.5.1 is affected Version 20.9.5.1_LI_Images is affected Version 20.9.4.1.6 is affected Version 20.14.1 is affected Version 20.14.1_LI_Images is affected Version 20.9.5.2 is affected Version 20.9.5.2.1 is affected Version 20.9.5.2_LI_Images is affected Version 20.12.3.1 is affected Version 20.12.4 is affected Version 20.15.1_LI_Images is affected Version 20.15.1 is affected Version 20.9.5.1.4 is affected Version 20.9.5.2.7 is affected Version 20.9.5.2.13 is affected Version 20.9.6 is affected Version 20.9.6_LI_Images is affected Version 20.9.5.2.14 is affected Version 20.6.8 is affected Version 20.12.4.0.03 is affected Version 20.16.1 is affected Version 20.16.1_LI_Images is affected Version 20.12.4_LI_Images is affected Version 20.9.5.2.16 is affected Version 20.12.4.0.4 is affected Version 20.12.401 is affected Version 20.9.5.3 is affected Version 20.9.5.3_LI_Images is affected Version 20.12.4.1_LI_Images is affected Version 20.12.4.1 is affected Version 20.9.5.2.21 is affected Version 20.9.6.0.3 is affected Version 20.12.4.0.6 is affected Version 20.15.2_LI_Images is affected Version 20.15.2 is affected Version 20.12.4_Monthly_ES5 is affected Version 20.12.5 is affected Version 20.12.5_LI_Images is affected Version 20.9.7_LI _Images is affected Version 20.9.7 is affected Version 20.15.3 is affected Version 20.15.3_ LI _Images is affected Version 20.12.501 is affected Version 20.12.5.1_LI_Images is affected Version 20.12.5.1 is affected Version 20.12.5.2_LI_Images is affected Version 20.12.5.2 is affected Version 20.15.3.1 is affected Version 20.15.4_LI_Images is affected Version 20.15.4 is affected Version 20.9.7.1_LI _Images is affected Version 20.9.7.1 is affected Version 20.18.1 is affected Version 20.18.1_LI_Images is affected Version 20.12.6_LI_Images is affected Version 20.12.6 is affected Version 20.12.5.1.01 is affected Version 26.0.1 is affected Version 20.9.8 is affected Version 20.9.8_LI_Images is affected Version 20.18.2 is affected Version 20.15.4.1_LI_Images is affected Version 20.15.4.1 is affected Version 20.18.2_LI_Images is affected Version 26.1.1 is affected Version 26.1.1_LI_Images is affected Version 20.18.2.1_LI_Images is affected Version 20.18.2.1 is affected Version 20.15.4.2_LI_Images is affected Version 20.15.4.2 is affected Version 20.12.6.1 is affected Version 20.12.6.1_LI_Images is affected Version 20.12.5.3 is affected Version 20.12.5.3_LI_Images is affected Version 20.9.8.2_LI_Images is affected Version 20.9.8.2 is affected Version 20.18.3 is affected Version 20.18.3_LI_Images is affected Version 20.15.5 is affected Version 20.15.5_LI_Images is affected Version 20.12.7 is affected Version 20.12.7_LI_Images is affected Version 20.9.9 is affected Version 20.9.9_LI_Images is affected Version 20.18.2.2 is affected Version 20.18.2.2_LI_Images is affected Version 20.12.5.4 is affected Version 20.12.5.4_LI_ Images is affected Version 20.12.7.1_LI_Images is affected Version 20.12.6.2_LI_Images is affected Version 20.12.7.1 is affected

Exploits

The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.

References

Problem Types

Improper Input Validation cwe