This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Cisco fixes 9 vulnerabilities
Cisco fixes 9 vulnerabilities in its products. The most severe of them are described below; the rest can be found at [1][2][3]. Based on evidence of active exploitation, CVE-2026-20182 has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog [4]. Fixed versions of individual products: Cisco ThousandEyes Virtual Appliance - 0.262.0 [1] Cisco Secure Workload - 3.10.8.3, 4.0.3.17 [5] Cisco Catalyst SD-WAN - 20.9.9.1, 20.12.7.1, 20.12.5.4, 20.12.6.2, 20.15.4.4, 20.15.5.2, 20.18.2.2, 26.1.1.1 [6][7] The availability of a fix for Cisco NX-OS Software can be verified using the Cisco Software Checker tool [8].
An unauthenticated remote attacker can bypass authentication, gain administrative privileges and manipulate the configuration of the SD-WAN infrastructure via NETCONF due to an improperly functioning authentication mechanism in Cisco Catalyst SD-WAN Controller and Catalyst SD-WAN Manager [6].
The vulnerability is present in product:
- Cisco Catalyst SD-WAN; <20.9; >=20.9, <20.9.9.1; >=20.10, <20.12.7.1; >=20.11, <20.12.7.1; >=20.12, <20.12.7.1; >=20.13, <20.15.5.2; >20.14, <20.15.5.2; >=20.15, <20.15.5.2; >=20.16, <20.18.2.2; >=20.18, <20.18.2.2; >=26.1, <26.1.1.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:X
More information:
- CVE-2026-20182 at cve.org, NVD
- CWE-287: Improper Authentication at cwe.mitre.org
The vulnerability was publicly disclosed 14. 5. 2026.
An unauthenticated remote attacker can read arbitrary files stored on the affected system due to improper handling of XML External Entities (XXE) when parsing an XML file in the web interface of Cisco Catalyst SD-WAN Manager [7].
The vulnerability is present in product:
- Cisco Catalyst SD-WAN; <20.9; >=20.9, <20.9.9.1; >=20.10, <20.12.7.1; >=20.11, <20.12.7.1; >=20.12, <20.12.7.1; >=20.13, <20.15.5.2; >20.14, <20.15.5.2; >=20.15, <20.15.5.2; >=20.16, <20.18.2.2; >=20.18, <20.18.2.2; >=26.1, <26.1.1.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
More information:
- CVE-2026-20224 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 14. 5. 2026.
An unauthenticated remote attacker can gain Site Admin role privileges, read sensitive information and make configuration changes across tenants due to insufficient validation and authentication when accessing internal REST API endpoints in Cisco Secure Workload [5].
The vulnerability is present in product:
- Cisco Secure Workload; <3.9; >=3.10, <3.10.8.3; >=4.0, <4.0.3.17
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:X
More information:
- CVE-2026-20223 at cve.org, NVD
- CWE-306: Missing Authentication for Critical Function at cwe.mitre.org
The vulnerability was publicly disclosed 20. 5. 2026.
Links
- [1] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tevacert-rce-RMJVEym5
- [2] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tebbot-cmdinj-wN3yQ5gn
- [3] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bgp-iefab-3hb2pwtx
- [4] https://www.cisa.gov/news-events/alerts/2026/05/14/cisa-adds-one-known-exploited-vulnerability-catalog
- [5] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csw-pnbsa-g8WEnuy
- [6] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW
- [7] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-mltvnps2-JxpWm7R
- [8] https://sec.cloudapps.cisco.com/security/center/softwarechecker.x
By CESNET, z.s.p.o. Michaela Jarošová on 21. 5. 2026.