Security readout for executives and security teams
Plain-English summary
Cisco SD-WAN vManage has an API flaw that can let an unauthenticated remote attacker read sensitive files. Cisco says exposed information could include credentials or user tokens. This is a confidentiality-focused issue, not an integrity or availability issue in the CVSS data, but credential exposure can create wider business impact.
Executive priority
Treat as high priority where vManage is reachable beyond tightly controlled admin networks. The direct risk is sensitive information disclosure, but exposed credentials or tokens can enable follow-on compromise outside this CVE’s stated impact.
Technical view
The issue is improper validation of directory traversal sequences in vManage application data API endpoints. It is classified as CWE-35 and scored CVSS 3.1 7.5: network-accessible, low complexity, no privileges, no user interaction, high confidentiality impact, no integrity or availability impact.
Likely exposure
Exposure is likely for organizations running affected Cisco SD-WAN vManage or Cisco Catalyst SD-WAN Manager versions, especially where management APIs are reachable from untrusted networks. The source bundle does not prove internet exposure for any specific deployment.
Exploitation context
The source bundle states an unauthenticated remote attacker could send malicious API requests to perform directory traversal and access sensitive information. KEV is false, and no cited source in the bundle confirms active exploitation.
Researcher notes
Evidence supports unauthenticated remote directory traversal against application data APIs, with possible credential or token disclosure. The bundle does not include exploit proof, affected endpoint names, fixed version mapping, or telemetry showing exploitation. Avoid claiming RCE, data modification, or service disruption from this CVE alone.
Mitigation direction
- Apply Cisco software updates that address this vulnerability.
- Use Cisco’s advisory to identify fixed releases for your deployment.
- Do not rely on workarounds; Cisco states none address this vulnerability.
- Prioritize externally reachable or broadly reachable vManage management planes.
- Check vendor guidance before making compensating-control claims.
Validation and detection
- Inventory Cisco SD-WAN vManage or Catalyst SD-WAN Manager versions.
- Compare installed versions against the affected version list and Cisco advisory.
- Confirm management API exposure from internal, partner, and internet paths.
- Review access logs for unusual API activity around application data endpoints.
- Assess whether exposed credentials or user tokens require rotation.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-35: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-26073 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/RL:X/RC:X/E:X
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/RL:X/RC:X/E:X3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/RL:X/RC:X/E:X
Source materials
- CVE List V5 sourceCVE List V5
- cisco-sa-vman-traversal-hQh24tmkCVE reference
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssl-dos-7uZWwSEyCVE reference
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-escalation-Jhqs5SkfCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Path Traversal: '.../...//'
Path Traversal: '.../...//' represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.