Changeflow GovPing Data Privacy & Cybersecurity Cisco Catalyst SD-WAN Manager XSS Vulnerability
Priority review Notice Amended Final

Cisco Catalyst SD-WAN Manager XSS Vulnerability

Favicon for wid.cert-bund.de CERT-Bund Security Advisories
Published March 25th, 2026
Detected March 26th, 2026
Email

Summary

CERT-Bund has issued a security advisory for Cisco Catalyst SD-WAN Manager, detailing a Cross-Site Scripting (XSS) vulnerability. The advisory provides affected product versions and a CVSS score indicating a medium severity. Mitigation guidance is available.

View original document View source feed page

What changed

CERT-Bund has published a security advisory (WID-SEC-2026-0872) concerning a Cross-Site Scripting (XSS) vulnerability in Cisco Catalyst SD-WAN Manager. The vulnerability, assigned a CVSS Base Score of 5.4 and Temporal Score of 4.7, allows a remote, authenticated attacker to execute arbitrary scripts in the user's browser. Several versions of Cisco Catalyst SD-WAN Manager are affected, including those prior to 20.12.5.3, 20.12.6.1, 20.15.4.2, and 20.18.2.1, as well as versions 20.13, 20.14, and prior to 20.15.5 and 20.16.

Organizations utilizing affected versions of Cisco Catalyst SD-WAN Manager should review the advisory for specific version information and apply available mitigations or update to patched versions as soon as possible to prevent potential exploitation. While the advisory indicates mitigation is available, the specific steps are not detailed in this summary, necessitating a review of the linked CERT-Bund advisory for actionable guidance to protect network infrastructure and data from XSS attacks.

What to do next

  1. Review affected Cisco Catalyst SD-WAN Manager versions
  2. Apply available mitigations or update to patched versions

Source document (simplified)

[WID-SEC-2026-0872] Cisco Catalyst SD-WAN Manager: Schwachstelle ermöglicht Cross-Site Scripting CVSS Base Score 5.4 (mittel) CVSS Temporal Score 4.7 (mittel) Remoteangriff ja Datum 25.03.2026 Stand 26.03.2026 Mitigation ja

Betroffene Systeme

Betriebssystem

  • CISCO Appliance

Produktbeschreibung

Cisco Catalyst SD-WAN ist eine Netzwerklösung, die Software-definierte Wide-Area-Networking-Funktionen (SD-WAN) mit Cisco Catalyst Series Switches kombiniert, um die Netzwerkleistung an verteilten Standorten zu optimieren und zu sichern.

Produkte

25.03.2026
- Cisco Catalyst SD-WAN Manager <20.12.5.3

  • Cisco Catalyst SD-WAN Manager <20.12.6.1

  • Cisco Catalyst SD-WAN Manager <20.15.4.2

  • Cisco Catalyst SD-WAN Manager <20.18.2.1

  • Cisco Catalyst SD-WAN Manager 20.13

  • Cisco Catalyst SD-WAN Manager 20.14

  • Cisco Catalyst SD-WAN Manager <20.15.5

  • Cisco Catalyst SD-WAN Manager 20.16

Angriff

Angriff

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Cisco Catalyst SD-WAN Manager ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen. CVE Informationen Versionshistorie Feedback zum Advisory geben

Named provisions

Betroffene Systeme Angriff

Related changes

Favicon for wid.cert-bund.de M-Files Server Information Disclosure Vulnerability Advisory
Priority review Apr 02, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity
Favicon for wid.cert-bund.de Cisco Nexus Vulnerabilities Allow File Manipulation, Data Disclosure
Routine Apr 02, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity
Favicon for wid.cert-bund.de IGEL UMS Vulnerability Allows Remote Information Disclosure
Priority review Apr 02, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cssf.lu Active Supply Chain Attack Targeting Axios NPM
Urgent Apr 04, 2026 • CSSF News • Banking & Finance
Favicon for www.cert.ssi.gouv.fr SUSE Linux Kernel Multiple Vulnerabilities Advisory
Priority review Apr 03, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiple Ubuntu Linux Kernel Vulnerabilities Allow Arbitrary Code Execution
Priority review Apr 03, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity

Source

Favicon for wid.cert-bund.de
CERT-Bund Security Advisories wid.cert-bund.de/content/public/securityAdvisory/rss
Data Privacy & Cybersecurity
Analysis generated by AI. Source diff and links are from the original.

Classification

Agency
CERT-Bund
Published
March 25th, 2026
Instrument
Notice
Legal weight
Non-binding
Stage
Final
Change scope
Substantive
Document ID
WID-SEC-2026-0872

Who this affects

Applies to
Technology companies
Industry sector
5112 Software & Technology
Activity scope
Network Security
Geographic scope
Germany DE

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF
Topics
Network Security Vulnerability Management

Browse Categories

Agriculture & Food Safety 63 AI Regulation 3 Banking & Finance 266 Consumer Protection 44 Courts & Legal 358 Data Privacy & Cybersecurity 74 Defense & National Security 52 Education 20 Energy 101 Environment 85 Government & Legislation 277 Healthcare 136 Housing 16 Immigration 9 Insurance 58 Labor & Employment 113 Pharma & Drug Safety 103 Securities & Markets 104 Tax 66 Telecom & Technology 47 Trade & Sanctions 124 Transportation 57

Get Data Privacy & Cybersecurity alerts

Weekly digest. AI-summarized, no noise.

Free. Unsubscribe anytime.

Get alerts for this source

We'll email you when CERT-Bund Security Advisories publishes new changes.

Optional. Personalizes your daily digest.

Free. Unsubscribe anytime.