CVE-2026-20262: Cisco Catalyst SD-WAN Manager arbitrary file write in web UI

CVE-2026-20262 · Severity: critical · CVSS 6.5 · Exploited in the wild · Published 2026-06-15

Cisco Catalyst SD-WAN Manager, a tool used to manage corporate wide-area networks, contains a security flaw that allows an authorized user to manipulate files on the system. By uploading specially crafted data, an attacker could overwrite critical system files or create new ones. This could lead to a total takeover of the management platform, potentially allowing the attacker to gain administrative (root) control over the network infrastructure.

Technologies: Cisco Catalyst SD-WAN Manager. Vendors: Cisco.

Quick answers

Is CVE-2026-20262 exploited in the wild?
Yes. CVE-2026-20262 is known to be exploited in the wild, first recorded on 15 June 2026. Treat it as urgent.
How severe is CVE-2026-20262?
Critical severity, with a CVSS score of 6.5, published 15 June 2026.
Which products and versions are affected?
Cisco Catalyst SD-WAN Manager 20.9.9.1 and earlier, 20.12.7.1 and earlier, 20.15.4.4 and earlier, 20.15.5.2 and earlier, 20.18.3, 26.1.1.1 and earlier.
Is there a fix for CVE-2026-20262?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20262 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20262?
Check whether you run Cisco Catalyst SD-WAN Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in the web UI of Cisco Catalyst SD-WAN Manager (formerly vManage) due to insufficient validation of user-supplied input during file upload processes. An authenticated, remote attacker with at least low-privileged access can exploit this by sending crafted HTTP requests to specific API endpoints. Successful exploitation allows the attacker to create or overwrite any file on the filesystem. This capability can be leveraged to achieve privilege escalation to root on the underlying operating system. The vulnerability is confirmed to be exploited in the wild.

Affected products

  • Cisco Catalyst SD-WAN Manager

Timeline

  • 2026-06-15: disclosed
  • 2026-06-15: advisory
  • 2026-06-15: exploited: Reported as exploited in the wild at the time of publication.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.