CVE-2026-20128

Cisco Catalyst SD-WAN Manager stores passwords in a recoverable format, allowing local attackers to escalate privileges by reading credential files.

This vulnerability enables local privilege escalation by exposing password files in a recoverable format, which poses a significant risk to DIB organizations relying on Cisco SD-WAN infrastructure for secure communications. While not a remote exploit, the local access vector combined with the recoverable password storage creates a high embarrassment score due to the avoidable nature of the flaw and its direct impact on authentication integrity.

Shame score — The vulnerability stems from a design flaw where passwords are stored in a recoverable format, which is a preventable security misconfiguration that undermines trust in Cisco's SD-WAN security posture.