CVE-2026-20224: Unauthenticated XXE File Read in Cisco Catalyst SD-WAN Manager

Executive Summary

CVE-2026-20224 is an XML External Entity flaw in the web UI of Cisco Catalyst SD-WAN Manager, formerly vManage, that lets an unauthenticated remote attacker read arbitrary files from the management appliance by sending a crafted XML request. In converged utility and pipeline networks where SD-WAN Manager governs the WAN fabric carrying SCADA and telemetry traffic, exposure of that appliance is a direct path to the credentials and topology data that describe the entire OT transport layer.

Technical Exposure Breakdown

The defect lives in the XML parser used by the SD-WAN Manager web UI. The parser processes untrusted XML without disabling external entity resolution. An attacker submits an XML document that declares an external entity referencing a local file path, and the parser dereferences that entity during processing, returning file contents in the response or through an out-of-band channel.

The attributes that make this dangerous are unambiguous. No authentication is required. No valid user credentials are needed. The attack vector is the network-facing HTTP interface. The CVSS score of 8.6 reflects a confidentiality impact against a control plane element rather than a single edge device.

What an attacker reads matters more than the read primitive itself. SD-WAN Manager stores configuration templates, device inventories, certificate material, and in many deployments database connection details and credential stores. A file read against this system is reconnaissance and credential harvesting in one request. The output is a blueprint of the WAN overlay and, potentially, the keys to move laterally across it.

KEV status: this CVE is not currently listed in the known exploited vulnerability catalog. That is not a reason to defer action. XXE primitives are trivial to weaponize once the vulnerable endpoint is identified, and management planes are high-value targets that draw attention quickly.

OT Impact and Compliance Risk

SD-WAN Manager is frequently the demarcation between IT-managed WAN and OT transport in geographically distributed operations. Water utilities with remote lift stations, electric cooperatives with substations, and pipeline operators with valve stations often ride SD-WAN overlays because the alternative is dedicated circuits at every site. Compromise of the manager does not brick a PLC directly, but it exposes the routing, segmentation, and trust relationships that keep OT traffic isolated from IT.

The compliance exposure is concrete. Under IEC 62443, this appliance sits at a zone boundary and the conduit it governs is now a demonstrable weakness in the segmentation model. For NERC CIP entities, an SD-WAN Manager that touches the routable connectivity of a BES Cyber System pulls into scope for electronic security perimeter and access control obligations, and an unauthenticated file read undermines the access management case. Pipeline operators subject to TSA Security Directive SD-02C should treat any unauthenticated read of network management state as a segmentation and access control finding. Water and wastewater systems operating under AWIA 2018 risk assessment obligations must document this as a control plane exposure affecting the entire distributed network.

Compensating Controls

Do not stop at the vendor advisory. Treat the management interface as hostile-facing until proven otherwise.

• Remove the web UI from any network an attacker can reach. The management plane should be accessible only from a dedicated administrative segment or jump host. If it currently answers on a general corporate VLAN, that is the first thing to fix.
• Deploy a virtual patch at the network layer. Front the HTTP interface with a proxy or IPS that inspects request bodies and strips or blocks XML payloads containing DOCTYPE declarations, ENTITY definitions, or SYSTEM and PUBLIC identifiers.
• Suricata rule concept: alert on POST or PUT traffic to the management UI where the payload contains <!DOCTYPE combined with <!ENTITY or the SYSTEM keyword. Pair content matching on these tokens with the destination address of the appliance to keep false positives low. Set the rule to drop in inline mode once tuned.
• Do not active-scan to confirm exposure. Aggressive probing of the management plane can disrupt the WAN control channel. Validate exposure through passive traffic inspection and configuration review, not by throwing crafted XXE payloads at production controllers.
• Rotate credentials and certificates that may have been readable if this appliance was internet-exposed for any meaningful window.

BreachSpider tracks exploitation signals and exposure changes across ICS and OT infrastructure so operators can act before a CVE reaches the known exploited vulnerability catalog.