Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format (CVE-2026-20128)

union DeviceNetworkEvents, DeviceProcessEvents, DeviceFileEvents
| where TimeGenerated > ago(7d)
| where DeviceName has_any ("sdwan", "vmanage", "sd-wan-manager") or RemoteUrl has_any ("vmanage", "sdwan-manager")
| where (ActionType in ("FileRead", "FileAccessed") and FolderPath has_any ("/etc/viptela", "/opt/nms", "vmanage", "sdwan", ".viptela"))
   or (ProcessCommandLine has_any ("sqlite3", "strings", "grep", "cat") and ProcessCommandLine has_any ("password", "passwd", "credential", "secret", "vmanage"))
   or (ActionType == "NetworkConnectionSuccess" and RemotePort in (8443, 8444, 443) and InitiatingProcessCommandLine has_any ("curl", "wget", "python", "ruby", "perl") and InitiatingProcessCommandLine has "vmanage")
| extend Severity = "High", CVE = "CVE-2026-20128"
| project TimeGenerated, DeviceName, ActionType, FolderPath, FileName, ProcessCommandLine, InitiatingProcessCommandLine, RemoteUrl, RemotePort, AccountName, CVE, Severity
| order by TimeGenerated desc

index=network OR index=endpoint OR index=syslog
(source="cisco:sdwan" OR source="vmanage" OR host IN ("*vmanage*", "*sdwan*", "*sd-wan-manager*"))
| eval suspicious_file_access=if(match(file_path, "(?i)(\/etc\/viptela|\/opt\/nms|vmanage|\.viptela)") AND match(action, "(?i)(read|open|access)"), 1, 0)
| eval credential_scraping=if(match(process_name, "(?i)(sqlite3|strings|grep|cat|awk|python|perl|ruby)") AND match(cmdline, "(?i)(password|passwd|credential|secret|vmanage|nms_server)"), 1, 0)
| eval suspicious_outbound=if(match(dest_port, "^(8443|8444|443)$") AND match(app, "(?i)(curl|wget|python|ruby|powershell)"), 1, 0)
| where suspicious_file_access=1 OR credential_scraping=1 OR suspicious_outbound=1
| eval cve="CVE-2026-20128", severity="high"
| eval detection_reason=case(suspicious_file_access=1, "Suspicious vManage config file access", credential_scraping=1, "Credential scraping command detected", suspicious_outbound=1, "Suspicious outbound from SD-WAN manager", true(), "Unknown")
| table _time, host, user, process_name, cmdline, file_path, dest, dest_port, detection_reason, cve, severity
| sort -_time

sequence by host.name with maxspan=10m
  [file where event.action in ("open", "read", "access") and
   file.path : ("/etc/viptela/*", "/opt/nms/*", "*vmanage*", "*.viptela*") and
   not process.name : ("vmanage", "nms_server", "confd")]
  [process where event.type == "start" and
   process.name : ("sqlite3", "strings", "grep", "cat", "python*", "perl", "ruby") and
   process.args : ("*password*", "*passwd*", "*credential*", "*secret*", "*vmanage*")]

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') as EventTime,
       sourceip, destinationip, username, QIDNAME(qid) as EventName,
       "File Path" as FilePath, "Process Name" as ProcessName,
       "Command Line" as CommandLine
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Cisco SD-WAN', 'Linux Syslog', 'Endpoint Management')
  AND devicetime > (CURRENT_TIMESTAMP - 604800000)
  AND (
    ("File Path" ILIKE '%/etc/viptela%' OR "File Path" ILIKE '%/opt/nms%' OR "File Path" ILIKE '%vmanage%')
    OR
    ("Process Name" ILIKE ANY ('%sqlite3%', '%strings%', '%grep%') AND "Command Line" ILIKE ANY ('%password%', '%passwd%', '%credential%', '%vmanage%'))
    OR
    ("Event Category" = 'Authentication' AND "Authentication Result" = 'Success' AND username ILIKE '%admin%' AND sourceip NOT INCIDR '10.0.0.0/8,172.16.0.0/12,192.168.0.0/16')
  )
ORDER BY devicetime DESC
LIMIT 500

_sourceCategory=cisco/sdwan OR _sourceCategory=network/sdwan OR _sourceCategory=endpoint
| where _raw matches /(?i)(vmanage|sdwan|viptela)/
| parse regex "(?P<file_path>\/etc\/viptela[^\s"']*|\/opt\/nms[^\s"']*)" nodrop
| parse regex "(?P<suspicious_cmd>(?:sqlite3|strings|python|perl|ruby)\s+[^\n]*(?:password|passwd|credential|secret))" nodrop
| parse regex "(?P<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" as source_ip nodrop
| where !isNull(file_path) or !isNull(suspicious_cmd)
| if(!isNull(file_path), "Config File Access", "Credential Scraping") as detection_type
| withtime _messagetime
| count by _messagetime, _sourceHost, detection_type, file_path, suspicious_cmd, source_ip
| sort by _messagetime desc

rule cve_2026_20128_sdwan_credential_exposure {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-20128 exploitation: credential extraction from Cisco Catalyst SD-WAN Manager"
    severity = "HIGH"
    cve = "CVE-2026-20128"
    mitre_attack = "T1552.001"

  events:
    (
      $e.metadata.event_type = "FILE_OPEN"
      and re.regex($e.target.file.full_path, `(?i)(/etc/viptela|/opt/nms|vmanage|\.viptela)`)
    )
    or
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($e.target.process.command_line, `(?i)(sqlite3|strings|python|perl|ruby).*(?:password|passwd|credential|secret|vmanage)`)
    )
    or
    (
      $e.metadata.event_type = "NETWORK_CONNECTION"
      and $e.target.port in (8443, 8444)
      and re.regex($e.principal.process.command_line, `(?i)(curl|wget|python|ruby)`)
    )

  condition:
    $e
}

#event_simpleName IN ("ProcessRollup2", "DnsRequest", "NetworkConnectIP4", "FileOpenInfo")
| FilePath LIKE "%/etc/viptela%" OR FilePath LIKE "%/opt/nms%" OR FilePath LIKE "%vmanage%"
  OR (ImageFileName LIKE "%sqlite3%" AND CommandLine LIKE "%password%")
  OR (ImageFileName LIKE "%python%" AND CommandLine LIKE "%vmanage%" AND CommandLine LIKE "%credential%")
  OR (RemoteAddressIP4 != NULL AND LocalPort IN (8443, 8444) AND ImageFileName LIKE "%curl%")
| eval CVE="CVE-2026-20128"
| eval DetectionType=case(
    FilePath LIKE "%viptela%" OR FilePath LIKE "%nms%", "Config File Access",
    ImageFileName LIKE "%sqlite3%", "Database Credential Scraping",
    ImageFileName LIKE "%python%" AND CommandLine LIKE "%vmanage%", "Scripted Credential Extraction",
    1==1, "Anomalous SD-WAN Activity"
  )
| table _time, ComputerName, UserName, ImageFileName, CommandLine, FilePath, RemoteAddressIP4, CVE, DetectionType
| sort -_time
| limit 200