CVE-2026-20128 Elastic Security · Elastic

Detect Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format (CVE-2026-20128) in Elastic Security

CVE-2026-20128 affects Cisco Catalyst SD-WAN Manager and involves storing passwords in a recoverable format (CWE-257). An attacker with local or network access to the SD-WAN Manager may be able to extract plaintext or weakly-obfuscated credentials from configuration files, databases, or memory. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Successful exploitation could lead to credential theft enabling lateral movement, further network compromise, or full SD-WAN infrastructure takeover.

MITRE ATT&CK

Tactic
Credential Access Persistence Lateral Movement

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.name with maxspan=10m
  [file where event.action in ("open", "read", "access") and
   file.path : ("/etc/viptela/*", "/opt/nms/*", "*vmanage*", "*.viptela*") and
   not process.name : ("vmanage", "nms_server", "confd")]
  [process where event.type == "start" and
   process.name : ("sqlite3", "strings", "grep", "cat", "python*", "perl", "ruby") and
   process.args : ("*password*", "*passwd*", "*credential*", "*secret*", "*vmanage*")]
high severity medium confidence

EQL sequence detection for CVE-2026-20128 correlating vManage configuration file access followed by credential-scraping process execution on the same host within 10 minutes, indicative of an attacker chaining file discovery with credential harvesting.

Data Sources

Elastic Endpoint SecurityFilebeatAuditbeat

Required Tables

logs-endpoint.events.file-*logs-endpoint.events.process-*

False Positives & Tuning

  • Legitimate database maintenance scripts accessing vManage SQLite databases
  • Authorized security tooling performing configuration baseline checks
  • Cisco-supplied diagnostic utilities triggering both file and process events in sequence

Other platforms for CVE-2026-20128

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1vManage SQLite Credential Database Direct Query

    Expected signal: Process creation event for sqlite3 with command line containing /opt/nms/db or credential-related terms; file access event on vManage database path

  2. Test 2Grep for Passwords in vManage Configuration Directory

    Expected signal: Process launch event for grep with arguments targeting /etc/viptela or similar paths and containing password-related search terms

  3. Test 3Unauthorized vManage REST API Credential Extraction via Python

    Expected signal: Process launch event for python3 with command line containing the vManage management port (8443) and credential/user-related API path; NetworkConnectionIP4 event to localhost:8443

  4. Test 4strings Utility Against vManage Process Memory or Binary

    Expected signal: Process creation for 'strings' with /proc/<pid>/exe or a vManage binary path as argument; subsequent grep process with credential search terms

Last updated: 2026-06-19 Research depth: standard
References (4)

Response Playbook

Triage

  1. Identify all hosts matching the hostname pattern (vmanage, sdwan-manager, sd-wan) and correlate against your SD-WAN Manager asset inventory to confirm scope of affected systems.
  2. Review authentication logs on the SD-WAN Manager for any successful logins occurring within 24 hours before and after the detection alert, particularly from unfamiliar source IPs or at unusual times.
  3. Check vManage audit logs (Administration > Audit Log) for any configuration exports, user creation, or privilege escalation events co-occurring with the detected activity.
  4. Determine whether the SD-WAN Manager API (port 8443) is exposed to the internet or untrusted network segments by reviewing firewall rules and NAT configurations.
  5. Assess whether any downstream SD-WAN edge devices have received unauthorized configuration pushes originating from the vManage instance in question.

Containment

  1. Immediately restrict access to the SD-WAN Manager web UI and REST API (ports 8443/8444) to only authorized management IP ranges via ACLs or firewall rules, and revoke any API tokens that cannot be immediately validated as legitimate.
  2. Force a password rotation for all accounts on the SD-WAN Manager instance, including local accounts, RADIUS/TACACS+ service accounts, and any credentials stored in vManage that may have been exposed due to the recoverable format vulnerability.
  3. Isolate the affected vManage instance from the production SD-WAN fabric by placing it in a quarantine VLAN while investigation proceeds, ensuring a secondary controller is promoted if available.

Evidence Collection

  1. Capture a full memory dump and disk image of the affected vManage VM prior to any remediation, preserving the state of credential storage databases (e.g., /opt/nms/db/, SQLite files) for forensic analysis.
  2. Export vManage audit logs, system logs (/var/log/nms/), and authentication logs covering at minimum 30 days prior to the alert, and preserve them to an out-of-band storage location not accessible from the SD-WAN management plane.
  3. Collect network flow records (NetFlow/IPFIX) from the management network segment for the 72-hour window surrounding the detection to identify any data exfiltration or lateral movement from the vManage host.

Escalation Criteria

  • !Escalate to incident response if evidence shows credentials extracted from vManage have been used to authenticate to other systems (lateral movement), or if unauthorized configuration changes were pushed to production SD-WAN edge devices.
  • !Escalate to CISO and executive leadership if the SD-WAN Manager is deployed in a federal, critical infrastructure, or regulated environment, given the CISA Known Exploited Vulnerability designation and associated Emergency Directive (ED-26-03).

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >vManage SQLite databases at /opt/nms/db/ containing user credential entries — check for evidence of unauthorized reads or copies
  • >Shell history files (.bash_history, .zsh_history) on the vManage Linux host for credential extraction commands (sqlite3, strings, grep -r password)
  • >vManage audit log at /var/log/nms/nms_server.log and the UI audit trail under Administration > Audit Log for unauthorized API calls or configuration exports
  • >SSH authorized_keys and /etc/passwd modifications on the vManage host indicating persistence mechanisms deployed post-exploitation
  • >Network pcap evidence of data exfiltration from management network (look for large outbound transfers on port 443 or 8443 to external IPs)

Tuning Guidance

Begin by baselining normal administrative access patterns to your SD-WAN Manager — document authorized management IP ranges, service account names, and typical API usage hours. Suppress false positives from known-good backup scripts by adding their specific process names or parent process names to an allowlist. For file access detections, scope triggers to exclude the vmanage process itself and Cisco-signed binaries accessing their own configuration directories. Tune confidence upward to HIGH if the source IP appears in threat intelligence feeds or if the detection correlates with after-hours access. Consider implementing Cisco's recommended hardening controls from CISA ED-26-03 supplemental guidance (network segmentation, API rate limiting, authentication logging) as compensating controls that also improve detection fidelity.

Hunting Queries

Hunt for historical credential-scraping tool execution against known vManage credential storage paths across the last 30 days, useful for identifying earlier stages of a breach or establishing attacker dwell time.

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where DeviceName has_any ("vmanage", "sdwan", "sd-wan-manager")
| where ProcessCommandLine has_any ("sqlite3", "strings") and ProcessCommandLine has_any ("/opt/nms", "/etc/viptela", "password", "passwd")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine
| order by TimeGenerated desc
Hunting — SPL
spl 
index=endpoint OR index=syslog host=*vmanage* OR host=*sdwan*
| search process IN ("sqlite3", "strings", "grep") cmdline IN ("*password*", "*passwd*", "*/opt/nms*", "*/etc/viptela*")
| table _time, host, user, process, cmdline
| sort -_time

Hunt for credential reuse across multiple source IPs suggesting stolen SD-WAN Manager credentials are being leveraged from different attacker-controlled hosts or VPN exit nodes.

Hunting — KQL
kql 
SigninLogs
| where TimeGenerated > ago(14d)
| where AppDisplayName has_any ("vManage", "SD-WAN", "Cisco") or ResourceDisplayName has_any ("vManage", "SD-WAN")
| where ResultType == 0
| summarize LoginCount=count(), UniqueIPs=dcount(IPAddress), IPList=make_set(IPAddress) by UserPrincipalName, bin(TimeGenerated, 1h)
| where UniqueIPs > 3
| order by TimeGenerated desc
Hunting — SPL
spl 
index=authentication sourcetype=cisco:sdwan:auth OR sourcetype=cisco:ise
| where action="success"
| stats count as login_count, dc(src_ip) as unique_ips, values(src_ip) as ip_list by user, span(_time, 1h)
| where unique_ips > 3
| sort -login_count

Atomic Red Team Tests

Test 1 vManage SQLite Credential Database Direct Query
linux

Simulates an attacker who has gained shell access to a Cisco vManage Linux host querying the underlying SQLite database to extract stored credentials in recoverable format.

Command

bash 
sqlite3 /opt/nms/db/vmanage_cloud_user_db 'SELECT username, password FROM users;' 2>/dev/null || sqlite3 /tmp/vmanage_sim.db 'CREATE TABLE IF NOT EXISTS users (username TEXT, password TEXT); INSERT INTO users VALUES ("admin","P@ssw0rd123"); SELECT username, password FROM users;'

Cleanup

bash 
rm -f /tmp/vmanage_sim.db

Expected Telemetry

Process creation event for sqlite3 with command line containing /opt/nms/db or credential-related terms; file access event on vManage database path

Expected Detection

Triggers credential_scraping logic in SPL/KQL detections; EQL sequence rule fires if preceded by file access to /opt/nms

Test 2 Grep for Passwords in vManage Configuration Directory
linux

Simulates an attacker using grep to recursively search vManage configuration directories for plaintext or weakly-encoded password strings, consistent with CWE-257 exploitation.

Command

bash 
grep -rn --include='*.conf' --include='*.json' --include='*.yaml' -i 'password\|passwd\|secret\|credential' /etc/viptela/ 2>/dev/null; grep -rn -i 'password' /tmp/viptela-sim/ 2>/dev/null; mkdir -p /tmp/viptela-sim && echo 'password: SuperSecret123' > /tmp/viptela-sim/vmanage.conf && grep -i password /tmp/viptela-sim/vmanage.conf

Cleanup

bash 
rm -rf /tmp/viptela-sim/

Expected Telemetry

Process launch event for grep with arguments targeting /etc/viptela or similar paths and containing password-related search terms

Expected Detection

Matches credential_scraping pattern in all SIEM detections; Chronicle YARA-L PROCESS_LAUNCH rule fires on regex match

Test 3 Unauthorized vManage REST API Credential Extraction via Python
linux

Simulates an attacker scripting credential extraction via the vManage REST API after obtaining initial API access, consistent with programmatic exploitation of recoverable credential storage.

Command

bash 
python3 -c "
import urllib.request, json, ssl
ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
try:
    req = urllib.request.Request('https://127.0.0.1:8443/dataservice/admin/user', headers={'Cookie': 'JSESSIONID=SIMULATED'})
    resp = urllib.request.urlopen(req, context=ctx, timeout=3)
except Exception as e:
    print(f'Simulated API credential extraction attempt: {e}')
print('CVE-2026-20128 atomic test complete')
"

Cleanup

bash 
No persistent artifacts created

Expected Telemetry

Process launch event for python3 with command line containing the vManage management port (8443) and credential/user-related API path; NetworkConnectionIP4 event to localhost:8443

Expected Detection

Triggers suspicious_outbound or scripted credential extraction logic in CrowdStrike CQL and KQL; Chronicle YARA-L NETWORK_CONNECTION rule fires on port 8443 with python initiating process

Test 4 strings Utility Against vManage Process Memory or Binary
linux

Simulates an attacker using the 'strings' utility to extract human-readable strings from vManage process memory dumps or binaries, looking for hardcoded or cached credentials in recoverable format.

Command

bash 
strings /proc/$(pgrep -f nms_server | head -1)/exe 2>/dev/null | grep -i 'password\|passwd\|secret' | head -20; strings /bin/ls 2>/dev/null | grep -i 'path\|config' | head -5; echo 'Simulated strings extraction against vManage process complete'

Cleanup

bash 
No persistent artifacts created

Expected Telemetry

Process creation for 'strings' with /proc/<pid>/exe or a vManage binary path as argument; subsequent grep process with credential search terms

Expected Detection

Triggers credential_scraping detection logic across KQL, SPL, and EQL detections; EQL sequence rule correlates with prior file access if vManage config was read first

Related Detections

Tactic Hubs

TA0006Credential AccessTA0003PersistenceTA0008Lateral Movement

Related Techniques

T1552Unsecured CredentialsT1552.001Credentials In FilesT1078Valid AccountsT1021Remote Services

Same Tactic: Credential Access

Popular Detections