CVE Tools
Sign in

CVE-2026-20262

Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability

Published: Jun 15, 2026Updated: Jul 24, 2026 Sources: CVE List NVD BDUCWE-22
6.5MEDIUM
NVD MITRE
EPSS Score
28.2%
Top 2.1%
CISA KEV
Active Exploitation
Since Jun 15, 2026
Exploits
0 Known
Remediation
Patch Available
Self-Check
OpenVAS

Description

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affected software does not properly validate user-supplied input during a file upload process. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected API endpoint of the affected system. A successful exploit could allow the attacker to create or overwrite any file on the underlying operating system. This file could later be used to elevate to root. To exploit this vulnerability, the attacker must have valid credentials with at least a lower-privileged, single-task user account.

In plain language

AI Act now

Cisco Catalyst SD-WAN Manager has a web UI problem that lets an attacker with valid (lower-privileged) login upload a crafted file to create or overwrite files on the server, which can lead to full device takeover; if you run this product, you should act now.

Executive summary

CVE-2026-20262 is an authenticated arbitrary file write in the web UI/file upload handling of Cisco Catalyst SD-WAN Manager (create/overwrite any filesystem file via crafted upload), which can enable privilege escalation to root; it is listed in CISA KEV with a due date of 2026-06-29 and has public exploits.

If affected, business impact
Complete SD-WAN controlFull system takeoverConfig and data tamperingLoss of network availability

What to do now

  1. Check whether your Cisco Catalyst SD-WAN Manager is on a version earlier than 20.9.9.2 by reviewing the system/version screen or your device inventory.
  2. If you use Catalyst SD-WAN Manager, upgrade it to 20.9.9.2 (or later) as directed in Cisco’s advisory.
  3. If you cannot upgrade immediately, restrict access to the Catalyst SD-WAN Manager web UI to trusted management networks only and remove it from the public internet, then implement Cisco’s mitigation guidance.
  4. After changes, verify the manager is reachable only from approved sources and monitor for suspicious upload/file-write activity in the web/app logs and admin audit trails.
Patch / advisory Usually a quick update

CVSS Vector Breakdown

AV:NAC:LPR:LUI:NS:UC:NI:HA:N
Exploitability
AV:NAttack Vector
Network
AC:LAttack Complexity
Low
PR:LPrivileges Required
Low
UI:NUser Interaction
None
Scope
S:UScope
Unchanged
Impact
C:NConfidentiality
None
I:HIntegrity
High
A:NAvailability
None
Open in CVSS calculator →

Weaknesses

CWE-22

Affected Products

Cisco Systems Inc.
commercial·USaka cisco, cisco systems
Catalyst SD-WAN Manager
Networking Infrastructure
Cisco Catalyst SD-WAN Manager
Networking Infrastructure
and 1 more affected products View all →

Exploitability

CISA Known Exploited Vulnerability
Added to KEV:Jun 15, 2026
Remediation due:Jun 29, 2026

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

0 exploit sources identified

Exploit details including PoC links, Metasploit modules, and scanner templates are available after registration.

View exploit details
Official Patch Available
Is your org exposed to CVE-2026-20262?We can run the check for you — a free external exposure review, no install. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

2 techniques
Collection
Discovery
View detailed technique mapping

References

https://o3.security/vulnerability/CVE-2026-20262
o3.security
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ
sec.cloudapps.cisco.com
https://socprime.com/blog/cve-2026-20262-cisco-sd-wan-manager-zero-day/
socprime.com
and 3 more references View all →
News mentions
9

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-20262 and every CVE in our database. Create a free account — no credit card required.

Create Free Account
Plain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows