LeakyCreds
NewInstant webhook alerts now available — notified within seconds of any credential detection.Learn more →
Home / Vulnerability Intelligence / CVE-2026-20224

CVE-2026-20224 - Vulnerability Analysis

HighCVSS: 8.6

Last Updated: May 14, 2026

Cisco Catalyst SD-WAN Manager - XML External Entity Injection

Published: May 14, 2026Updated: May 14, 2026Remote Exploitable

Overview

Cisco Catalyst SD-WAN Manager contains an XML External Entity Injection caused by improper handling of XML entities in the web UI, letting unauthenticated remote attackers read arbitrary files, exploit requires sending crafted XML requests.

Severity & Score

Severity: High
CVSS Score: 8.6
EPSS Score: 0.0%(Probability of exploitation in next 30 days)

Impact

Unauthenticated remote attackers can read arbitrary files on the affected system, potentially exposing sensitive information.

Mitigation

Update to the latest available version that addresses this vulnerability.

References

Social Media Activity(2 posts)

AA
AA
@AAKL
May 14, 2026

I'm almost inclined to gloat after the 4000 (mere change) layoffs because "look, we're drowning in money. Who needs people?" - CRITICAL: CVE-2026-20182: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW - CRITICAL: CVE-2026-20209, CVE-2026-20210 CVE-2026-20224: Cisco Catalyst SD-WAN Manager Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-mltvnps2-JxpWm7R @TalosSecurity #infosec #Cisco #vulnerability @cR0w

View original post
AA
AA
@AAKL
May 14, 2026

I'm almost inclined to gloat after the 4000 (mere change) layoffs because "look, we're drowning in money. Who needs people?" - CRITICAL: CVE-2026-20182: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW - CRITICAL: CVE-2026-20209, CVE-2026-20210 CVE-2026-20224: Cisco Catalyst SD-WAN Manager Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-mltvnps2-JxpWm7R @TalosSecurity #infosec #Cisco #vulnerability @cR0w

View original post

Related Resources

Details

CVE ID
CVE-2026-20224
Severity
High
CVSS Score
8.6
Type
xml_external_entity_injection
Status
unconfirmed
EPSS
0.0%
Social Posts
2

CWE

  • CWE-20

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS Score

0.0%Probability of exploitation in the next 30 days