# Cisco Catalyst SD-WAN Manager Exploitation: Patch CVE-2024-20437 Now > Cisco confirms active exploitation of two high-severity flaws in Catalyst SD-WAN Manager, involving hardcoded credentials and authentication bypass. - Published: 2026-03-05T12:20:31.000Z - Severity: critical - Category: Vulnerabilities - Tags: Cisco, SD WAN, CVE-2024-20437, CVE-2024-20440, Exploitation - Author: Runtime Rebel Intel - Primary source: https://www.securityweek.com/cisco-warns-of-more-catalyst-sd-wan-flaws-exploited-in-the-wild/ - Canonical: https://runtimerebel.com/blog/cisco-catalyst-sd-wan-manager-exploitation-patch-cve-2024-20437-now ## Key points - Threat actors are actively exploiting two high-severity vulnerabilities in Cisco Catalyst SD-WAN Manager to gain unauthorized access and sensitive data. - The vulnerabilities affect Cisco Catalyst SD-WAN Manager instances running vulnerable software versions including 20.x and 19.x series. - Organizations must apply the latest software updates immediately to patch hardcoded credentials and authentication bypass flaws. Cisco has updated its security advisories to warn that two vulnerabilities affecting the Catalyst SD-WAN Manager are being actively exploited in the wild. These flaws, [CVE-2024-20437](https://nvd.nist.gov/vuln/detail/CVE-2024-20437) and [CVE-2024-20440](https://nvd.nist.gov/vuln/detail/CVE-2024-20440), represent a significant risk to enterprise network orchestration and security posture. According to [SecurityWeek](https://www.securityweek.com/cisco-warns-of-more-catalyst-sd-wan-flaws-exploited-in-the-wild/), both vulnerabilities have been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies and suggesting private organizations patch these systems with high urgency. ## Technical Analysis of Exploited SD-WAN Vulnerabilities The vulnerabilities target the management plane of Cisco’s Software-Defined Wide Area Network (SD-WAN) solution. This centralized management system is a high-value target for [APT](/glossary#apt) groups because it allows for [Lateral Movement](/glossary#lateral-movement) and the configuration of traffic routing across an entire global enterprise network. ### CVE-2024-20437: Hardcoded Credentials This [CVE](/glossary#cve) involves the existence of a system account with static, hardcoded credentials. These credentials are used by the underlying software for internal operations, but the flaw allows an unauthenticated, remote attacker to use these credentials to log in to the affected system. While the [CVSS](/glossary#cvss) score is 7.5, the impact is severe as it provides a foothold into the SD-WAN management interface without any prior knowledge of user accounts or passwords. Defenders should focus on **how to detect CVE-2024-20437 exploit** attempts by monitoring logs for unauthorized logins to system accounts that should typically not see external or user-initiated traffic. ### CVE-2024-20440: Improper Authorization and Information Disclosure With a critical CVSS score of 9.8, CVE-2024-20440 is the more dangerous of the two flaws. It stems from improper validation of authorization in the web-based management interface. A remote, unauthenticated attacker can send crafted HTTP requests to the vulnerable device to gain unauthorized access to the application. This can lead to the exposure of sensitive configuration data, the creation of new administrative accounts, or the modification of network policies. This type of [RCE](/glossary#rce) potential or full-system compromise makes it a priority for [SOC](/glossary#soc) teams to identify and remediate immediately. ## Cisco Catalyst SD-WAN Manager Patch Guidance for Administrators Administrators must prioritize the application of software updates to **mitigate Cisco SD-WAN authentication bypass** risks. Cisco has released fixed software versions for all supported branches of the Catalyst SD-WAN Manager (formerly vManage). Security teams should follow this **Cisco Catalyst SD-WAN Manager patch guidance**: * **Verify Software Version**: Identify if your SD-WAN Manager is running affected versions (primarily 20.6, 20.9, and 20.12 releases prior to the fixes). * **Update Immediately**: Transition to a fixed release as specified in the Cisco Security Advisory. For CVE-2024-20437, there is no workaround, making the patch the only viable defense. * **Review Logs**: Audit the SD-WAN Manager logs for any [IoC](/glossary#ioc) related to unauthorized access or unusual administrative changes dating back to the initial disclosure. * **Restrict Access**: Implement [Zero Trust](/glossary#zero-trust) principles by ensuring the management interface of the SD-WAN Manager is not exposed to the public internet and is only accessible via a secure, authenticated VPN or management segment. Given that these vulnerabilities are being used in active campaigns, simple [EDR](/glossary#edr) coverage on endpoints may not be sufficient to detect the [TTP](/glossary#ttp) used against the networking appliance itself. Monitoring traffic to the management plane and integrating these logs into a [SIEM](/glossary#siem) for behavioral analysis is recommended to identify post-exploitation activity or attempts to leverage these flaws for further compromise of the enterprise backbone. **Related:** [Cisco SD-WAN Zero-Day CVE-2026-20127 Exploited for Admin Access](/blog/cisco-sd-wan-zero-day-cve-2026-20127-exploited-for-admin-access), [Cisco Catalyst SD-WAN Manager CVE-2023-20252 — Mitigation Guide](/blog/cisco-catalyst-sd-wan-manager-cve-2023-20252-mitigation-guide) --- AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/cisco-catalyst-sd-wan-manager-exploitation-patch-cve-2024-20437-now