Update taxonomy

Author: actions-user

taxonomy/scenarios.json

@@ -3864,6 +3864,51 @@
       "CWE-78"
     ]
   },
+  "crowdsecurity/vpatch-CVE-2026-20127-dca-disclosure": {
+    "name": "crowdsecurity/vpatch-CVE-2026-20127-dca-disclosure",
+    "description": "Detects unauthenticated access to the DCA credential file in Cisco Catalyst SD-WAN Manager (CVE-2026-20127)",
+    "label": "Cisco SD-WAN vManage - Credentials Disclosure",
+    "behaviors": [
+      "http:exploit"
+    ],
+    "mitre_attacks": [
+      "TA0001:T1190"
+    ],
+    "confidence": 3,
+    "spoofable": 0,
+    "cti": true,
+    "service": "http",
+    "created_at": "2026-03-06T10:00:35",
+    "cves": [
+      "CVE-2026-20127"
+    ],
+    "cwes": [
+      "CWE-552"
+    ]
+  },
+  "crowdsecurity/vpatch-CVE-2026-20127": {
+    "name": "crowdsecurity/vpatch-CVE-2026-20127",
+    "description": "Detects path traversal file upload exploitation in Cisco Catalyst SD-WAN Manager (CVE-2026-20127)",
+    "label": "Cisco SD-WAN vManage - RCE",
+    "behaviors": [
+      "http:exploit"
+    ],
+    "mitre_attacks": [
+      "TA0001:T1190"
+    ],
+    "confidence": 3,
+    "spoofable": 0,
+    "cti": true,
+    "service": "http",
+    "created_at": "2026-03-06T10:00:35",
+    "cves": [
+      "CVE-2026-20127"
+    ],
+    "cwes": [
+      "CWE-22",
+      "CWE-434"
+    ]
+  },
   "crowdsecurity/vpatch-CVE-2026-23744": {
     "name": "crowdsecurity/vpatch-CVE-2026-23744",
     "description": "Detects RCE in MCPJam Inspector via crafted POST to /api/mcp/connect",