CVE-2026-20122 Elastic Security · Elastic

Detect Cisco Catalyst SD-WAN Manager Privileged API Abuse (CVE-2026-20122) in Elastic Security

Detects exploitation of CVE-2026-20122, a critical vulnerability in Cisco Catalyst SD-WAN Manager involving incorrect use of privileged APIs (CWE-648). This KEV-listed flaw allows attackers to invoke privileged API endpoints without proper authorization, potentially enabling unauthorized configuration changes, credential harvesting, or full SD-WAN infrastructure takeover. Active exploitation has been observed in the wild per CISA Emergency Directive ED-26-03.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Defense Evasion Lateral Movement

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by source.ip with maxspan=5m
  [network where
    destination.port in (443, 8443, 8080) and
    url.path : ("/dataservice/admin*", "/dataservice/system*", "/dataservice/device/action*", "/dataservice/template*", "/dataservice/settings/configuration*", "/dataservice/certificate*", "/dataservice/aaa*") and
    http.request.method in ("POST", "PUT", "DELETE", "PATCH") and
    http.response.status_code in (200, 201, 204)
  ] with runs=3
critical severity medium confidence

EQL sequence rule detecting three or more successful privileged API mutations from the same source IP within 5 minutes, targeting known Cisco SD-WAN Manager administrative API namespaces consistent with CVE-2026-20122 abuse.

Data Sources

Elastic Network LogsPacketbeatWeb Application Firewall logs

Required Tables

logs-network*logs-apm*packetbeat-*

False Positives & Tuning

  • Bulk API-driven provisioning workflows executed by authorized network automation accounts
  • SD-WAN health monitoring agents that authenticate and query multiple admin endpoints in rapid succession
  • Load balancer health checks misconfigured to probe privileged API paths

Other platforms for CVE-2026-20122

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Unauthenticated SD-WAN Manager Privileged API Probe

    Expected signal: HTTP GET requests to /dataservice/admin/user, /dataservice/system/information, /dataservice/aaa/usergroup, /dataservice/certificate/list from the test host to port 8443, logged in vManage access logs and network flow.

  2. Test 2Privileged API Admin Account Creation Simulation

    Expected signal: POST to /dataservice/aaa/user with a new username payload logged in vManage audit log, network capture showing the request body containing userName and group fields.

  3. Test 3SD-WAN Manager Template Enumeration and Exfiltration Simulation

    Expected signal: Sequential GET requests to /dataservice/template/device, /dataservice/template/feature, /dataservice/device, and /dataservice/device/action/list within a short timeframe from a single source IP.

  4. Test 4Rapid Privileged API Burst from Single Source

    Expected signal: 21+ HTTP requests across 7 distinct privileged API paths within seconds, all from the same source IP, logged in vManage access logs and network telemetry.

Last updated: 2026-06-19 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the source IP is not a known administrative host by cross-referencing the SD-WAN Manager authorized management IP whitelist and IPAM records.
  2. Identify which specific privileged API paths were accessed — paths under /dataservice/aaa, /dataservice/certificate, or /dataservice/admin are highest priority for privilege escalation assessment.
  3. Review SD-WAN Manager audit logs (available at /dataservice/auditlog) for corresponding user session records tied to the source IP, checking for session creation without a preceding authentication event.
  4. Determine whether any API responses included device configuration data, credentials, or template payloads that could indicate data exfiltration alongside privilege abuse.
  5. Check CISA ED-26-03 supplemental hunting guidance for IOCs and compare against observed source IPs, user agents, and API call patterns.

Containment

  1. Immediately block the offending source IP at the perimeter firewall and any SD-WAN Manager network ACL, preventing further privileged API access while investigation proceeds.
  2. If exploitation is confirmed, isolate the SD-WAN Manager instance by restricting management plane access to a dedicated, monitored jump host and revoke all active API tokens; force re-authentication for all administrative sessions.
  3. Apply the Cisco patch referenced in cisco-sa-sdwan-authbp-qwCX8D4v and validate successful remediation before restoring normal management access.

Evidence Collection

  1. Export the full SD-WAN Manager audit log from /dataservice/auditlog for the incident window and preserve to write-once storage, including all entries for the offending source IP and any user accounts that authenticated around the same time.
  2. Capture NetFlow or PCAP for traffic between the attacker IP and the SD-WAN Manager management interface, focusing on request/response body sizes that may indicate credential or configuration data transfer.
  3. Collect vManage application logs from /var/log/nms/ on the SD-WAN Manager host and preserve the running configuration snapshot to baseline any unauthorized changes made via the exploited privileged APIs.

Escalation Criteria

  • !Escalate immediately if the /dataservice/aaa or /dataservice/certificate endpoint was successfully invoked, as these allow creation of rogue admin accounts or injection of attacker-controlled certificates, indicating full infrastructure compromise.
  • !Escalate if SD-WAN device templates or device action endpoints were modified, as this could have pushed malicious configurations to managed WAN edge devices across the entire SD-WAN overlay network.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >Cisco vManage audit log entries at /dataservice/auditlog showing API calls without valid preceding session authentication
  • >NMS application logs at /var/log/nms/vmanage-server.log on the SD-WAN Manager host containing REST API handler error messages or privilege bypass indicators
  • >Network flow records showing connections from unexpected source IPs to TCP 8443 or 443 on the SD-WAN Manager management interface
  • >SD-WAN Manager database entries in the user and certificate tables for accounts or certificates created around the time of exploitation

Tuning Guidance

Begin by baselining your SD-WAN Manager management IP whitelist and restricting the detection scope to traffic originating outside those known-good management hosts. If your organization uses API-driven automation, create an allowlist of service account user agents and source IPs and exclude them from alerting. Tune the request_count and unique_api_paths thresholds upward in environments with heavy automation. For highest-fidelity detection, correlate API access events with authentication log entries — API calls lacking a preceding successful authentication event within the same session are the strongest signal and should never be suppressed. In environments where SD-WAN Manager is behind a WAF or reverse proxy, ensure the detection operates on the upstream client IP rather than the proxy IP.

Hunting Queries

Threat hunt for unauthenticated or session-less successful mutations to Cisco SD-WAN Manager API endpoints over the past 7 days — identifies historical exploitation attempts that may predate alert tuning.

Hunting — KQL
kql 
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where DeviceVendor =~ "Cisco" and DeviceProduct has_any ("SD-WAN", "vManage")
| where RequestURL has "/dataservice/"
| where isempty(DestinationUserName) or DestinationUserName == ""
| where RequestMethod in ("POST", "PUT", "DELETE", "PATCH")
| where toint(EventOutcome) between (200 .. 299)
| summarize count() by SourceIP, RequestURL, RequestMethod
| where count_ >= 2
| sort by count_ desc
Hunting — SPL
spl 
index=network sourcetype IN ("cisco:sdwan", "cisco:vmanage") earliest=-7d
| eval api_path=coalesce(uri, url, request_uri)
| eval method=coalesce(method, http_method)
| eval status=coalesce(status, http_status_code)
| eval user=coalesce(user, username, cs_username)
| where match(api_path, "/dataservice/")
| where (isnull(user) OR user="" OR user="-")
| where method IN ("POST", "PUT", "DELETE", "PATCH")
| where status IN ("200", "201", "204")
| stats count AS hits, values(api_path) AS paths BY src_ip
| where hits >= 2
| sort - hits

Atomic Red Team Tests

Test 1 Unauthenticated SD-WAN Manager Privileged API Probe
linux

Simulates an attacker probing the Cisco SD-WAN Manager admin API endpoints without a valid session token to test for CVE-2026-20122 privilege bypass. Lab use only — run against an isolated vManage instance.

Command

bash 
TARGET_IP="192.168.100.10"; for endpoint in "/dataservice/admin/user" "/dataservice/system/information" "/dataservice/aaa/usergroup" "/dataservice/certificate/list"; do echo "[*] Testing: $endpoint"; curl -sk -X GET "https://${TARGET_IP}:8443${endpoint}" -H 'Content-Type: application/json' -w "\nHTTP Status: %{http_code}\n"; done

Cleanup

bash 
No persistent changes — read-only probe. Verify no session artifacts remain in vManage audit log if test is complete.

Expected Telemetry

HTTP GET requests to /dataservice/admin/user, /dataservice/system/information, /dataservice/aaa/usergroup, /dataservice/certificate/list from the test host to port 8443, logged in vManage access logs and network flow.

Expected Detection

Alert should fire when 3+ distinct privileged API paths are accessed from the same source IP. If the vulnerability is present and returns 200, the high-severity variant should trigger.

Test 2 Privileged API Admin Account Creation Simulation
linux

Simulates post-exploitation account persistence via the SD-WAN Manager /dataservice/aaa/user endpoint, mimicking attacker behavior after CVE-2026-20122 privilege bypass. Lab use only.

Command

bash 
TARGET_IP="192.168.100.10"; SESSION_TOKEN=$(curl -sk -X POST "https://${TARGET_IP}:8443/j_security_check" -d 'j_username=admin&j_password=admin' -c /tmp/sdwan_cookie.txt -w '%{http_code}' -o /dev/null); curl -sk -X POST "https://${TARGET_IP}:8443/dataservice/aaa/user" -b /tmp/sdwan_cookie.txt -H 'Content-Type: application/json' -d '{"userName":"attacker_backdoor","password":"Attack3r!2026","group":["netadmin"],"description":"test"}' -w "\nHTTP Status: %{http_code}\n"; rm -f /tmp/sdwan_cookie.txt

Cleanup

bash 
DELETE the created user via: curl -sk -X DELETE "https://${TARGET_IP}:8443/dataservice/aaa/user/attacker_backdoor" with admin credentials. Verify user no longer appears in /dataservice/aaa/user output.

Expected Telemetry

POST to /dataservice/aaa/user with a new username payload logged in vManage audit log, network capture showing the request body containing userName and group fields.

Expected Detection

The mutation to /dataservice/aaa should trigger the privileged API detection rule at critical severity, especially if the session was not preceded by a standard authentication event.

Test 3 SD-WAN Manager Template Enumeration and Exfiltration Simulation
linux

Simulates attacker reconnaissance of device templates via the privileged /dataservice/template endpoint to understand network topology, as an attacker would after exploiting CVE-2026-20122.

Command

bash 
TARGET_IP="192.168.100.10"; for endpoint in "/dataservice/template/device" "/dataservice/template/feature" "/dataservice/device" "/dataservice/device/action/list"; do echo "[*] Querying: $endpoint"; curl -sk -X GET "https://${TARGET_IP}:8443${endpoint}" -H 'Content-Type: application/json' -H 'Accept: application/json' -w "\nHTTP Status: %{http_code}\n" | python3 -m json.tool 2>/dev/null | head -20; sleep 1; done

Cleanup

bash 
Read-only enumeration — no cleanup required. Verify no scheduled device actions were inadvertently triggered.

Expected Telemetry

Sequential GET requests to /dataservice/template/device, /dataservice/template/feature, /dataservice/device, and /dataservice/device/action/list within a short timeframe from a single source IP.

Expected Detection

The unique_apis threshold of 2+ distinct privileged paths should trigger the detection rule at high severity, with the /dataservice/device/action path elevating to critical if write methods are used.

Test 4 Rapid Privileged API Burst from Single Source
linux

Simulates a high-volume exploit attempt or automated exploitation framework targeting CVE-2026-20122 by rapidly iterating across multiple privileged API endpoints, matching the rate patterns of known exploit tooling.

Command

bash 
TARGET_IP="192.168.100.10"; ENDPOINTS=("/dataservice/admin/user" "/dataservice/settings/configuration" "/dataservice/certificate/list" "/dataservice/aaa/usergroup" "/dataservice/system/information" "/dataservice/admin/user/permission" "/dataservice/device/action/list"); for i in {1..3}; do for ep in "${ENDPOINTS[@]}"; do curl -sk -X GET "https://${TARGET_IP}:8443${ep}" -H 'Content-Type: application/json' -o /dev/null -w "${ep}: %{http_code}\n"; done; done

Cleanup

bash 
No persistent changes. Clear any connection entries from SD-WAN Manager session table if accessible.

Expected Telemetry

21+ HTTP requests across 7 distinct privileged API paths within seconds, all from the same source IP, logged in vManage access logs and network telemetry.

Expected Detection

Should trigger at critical risk score given unique_apis >= 4 threshold is met, and request_count will significantly exceed the minimum threshold of 3.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0005Defense EvasionTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1078Valid AccountsT1098Account ManipulationT1021Remote Services

Same Tactic: Initial Access

Popular Detections