Cisco SD-WAN vManage - RCE (CVE-2026-20127)
Description
A vulnerability in Cisco Catalyst SD-WAN Manager (vManage) allows an unauthenticated, remote attacker to achieve remote code execution on an affected device. The exploit chain involves unauthenticated access to the data collection agent configuration endpoint to obtain a privileged credential, which is then used to upload a malicious WAR file with a path-traversal filename to the smart licensing upload endpoint, deploying a webshell into the WildFly application server deployment directory.
psychologyCrowdSec Analysis
CVE-2026-20127 is a critical pre-authentication remote code execution vulnerability in Cisco Catalyst SD-WAN Manager (vManage). The exploit chain begins with unauthenticated retrieval of a data collection agent credential from an exposed configuration endpoint, which is then used to authenticate as a privileged internal service account. The attacker then uploads a malicious WAR file using a path-traversal filename to the smart licensing acknowledgment endpoint, causing the WildFly application server to deploy a JSP webshell, granting full remote code execution on the underlying host.
CrowdSec has been tracking this vulnerability and its exploits since 6th of March 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-20127 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers send a GET request to /reports/data/opt/data/containers/config/data-collection-agent/.dca to retrieve the DCA key unauthenticated, then POST to /jts/authenticated/j_security_check with username viptela-reserved-dca and the stolen key, and finally POST a multipart WAR file with a path-traversal filename to /dataservice/smartLicensing/uploadAck to deploy a webshell into the WildFly deployment directory.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-01-01 |
| CISA KEV | 2026-02-25 |
| CISA Remediation Deadline | 2026-02-27 |
| Rule Released | 2026-03-06 |
| CrowdSec First Seen | 2026-03-06 |
Related Weaknesses
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
The product makes files or directories accessible to unauthorized actors, even though they should not be.
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.