Cisco SD-WAN Manager XXE Flaw Grants Unauthenticated Access to Private Files

### Executive Summary Cisco disclosed multiple vulnerabilities in Catalyst SD-WAN Manager (vManage), most notably CVE-2026-20224, an unauthenticated XML External Entity (XXE) issue rated Critical (CVSS 8.6) that can enable remote attackers to read arbitrary files. Two additional Medium-severity privilege escalation bugs allow read-only users to obtain high privileges by exploiting sensitive session data in logs or unredacted device configuration data. Cisco reports no workarounds and provides fixed release versions, urging administrators to upgrade immediately; unsupported releases should migrate to a supported version.