1name: crowdsecurity/vpatch-CVE-2026-20127-dca-disclosure
2description: 'Detects unauthenticated access to the DCA credential file in Cisco Catalyst SD-WAN Manager (CVE-2026-20127)'
3rules:
4  - and:
5      - zones:
6          - URI
7        transform:
8          - urldecode
9          - lowercase
10          - normalizepath
11        match:
12          type: contains
13          value: '/reports/data/opt/data/containers/config/data-collection-agent/.dca'
14
15labels:
16  type: exploit
17  service: http
18  confidence: 3
19  spoofable: 0
20  behavior: 'http:exploit'
21  label: 'Cisco SD-WAN vManage - Credentials Disclosure'
22  classification:
23    - cve.CVE-2026-20127
24    - attack.T1190
25    - cwe.CWE-552