Intel

CVE-2026-20262

Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability

criticalKEV: actively exploitedPoCEPSS 28%

Description

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affected software does not properly validate user-supplied input during a file upload process. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected API endpoint of the affected system. A successful exploit could allow the attacker to create or overwrite any file on the underlying operating system. This file could later be used to elevate to root. To exploit this vulnerability, the attacker must have valid credentials with at least a lower-privileged, single-task user account.

Source: CISCO_CSAFCISA_KEVNVDCVELISTV5BSI_CSAFBSI

Response & Mitigation

Why act now?

Prioritisation rationale

Despite a moderate CVSS v3 base score of 6.5 (AV:N/AC:L/PR:L/UI:N), the EPSS score sits at the 98th percentile, indicating an exceptionally high probability of active exploitation relative to the broader CVE population. The vulnerability allows an attacker holding only a low-privileged single-task account to overwrite arbitrary files on the SD-WAN Manager operating system, providing a direct path to root-level privilege escalation and full control of the SD-WAN management plane. For NIS2-regulated operators and KRITIS organisations using Cisco Catalyst SD-WAN to manage critical WAN connectivity, the blast radius is severe: a compromised SD-WAN Manager can be leveraged to manipulate routing policies, exfiltrate network configuration data, or disrupt wide-area connectivity. Although CISA has not flagged known ransomware campaign use, the low barrier to exploitation — valid but minimal credentials are sufficient — combined with the critical infrastructure context warrants immediate patch prioritisation ahead of all routine maintenance work.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch first: Retrieve the Cisco Security Advisory for CVE-2026-20262 and install the fixed releases. Affected version branches include 20.9.x, 20.10–20.12.x, 20.13–20.15.x, 20.16–20.18.x, and 26.1.x — consult the Cisco advisory (cisco.com/security/advisories) for the exact target version per branch.
  • Restrict network access to the SD-WAN Manager Web UI: Immediately limit access to the management interface (default port 443/TCP) to trusted administrator source IP ranges via firewall ACL; remove any direct internet exposure of the vManage UI.
  • Audit all active user accounts: Enumerate all accounts with reduced privileges (single-task users) in SD-WAN Manager; disable any accounts that are not operationally required and review recent login activity for anomalies.
  • Inspect the filesystem for unauthorised files: Search the affected system for recently created or modified files outside expected directories — focus on /etc, /var, cron directories, and SSH authorized_keys files.
  • Triage API access logs: Review the last 30 days of Web UI API logs for suspicious file-upload requests (HTTP POST/PUT) containing path-traversal patterns such as ../.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Run SD-WAN Manager exclusively in a dedicated management VLAN; enforce firewall rules blocking east-west traffic between the management plane and production networks.
  • WAF/IPS rule: Block or alert on HTTP requests containing path-traversal sequences (../, %2e%2e%2f, %252e%252e) in the URI or multipart body at the upstream reverse proxy or IPS. Suggested Snort/Suricata rule: alert http any any -> $VMANAGE_IP 443 (msg:"CVE-2026-20262 Path Traversal"; content:"../"; http_uri; sid:2026202620; rev:1;)
  • Least-privilege / IAM hardening: Reduce single-task user accounts to the operational minimum; enforce multi-factor authentication for all accounts with Web UI access.
  • Filesystem hardening: Mount critical system directories (/etc, /boot, SSH configuration paths) with noexec/ro options where feasible; apply SELinux or AppArmor policies to prevent the vManage process from writing outside its expected directories.
  • API endpoint restriction: Disable or ACL-block unused SD-WAN Manager API endpoints; if operationally viable, block file-upload functionality at the network layer until the patch is applied.

Runbook · Step 3

Detection rules

  • Web server access log (Nginx/Apache): Search for POST/PUT requests to API endpoints containing path-traversal patterns: grep -E '(\.\./|%2e%2e%2f|%252e%252e)' /var/log/nginx/access.log
  • Auditd / Linux filesystem monitoring: Alert on file creation or modification outside expected upload directories by the vManage process: auditd: -w /etc -p wa -k vmanage_etc_write and -w /root/.ssh/authorized_keys -p wa -k vmanage_ssh_key
  • Sigma rule (process level): Detect unexpected child processes spawned by the vManage web service process — a likely indicator of privilege escalation following file overwrite: Sigma: process_creation | where ParentImage contains 'vmanage' AND Image in ('sh','bash','python','perl')
  • SIEM/KQL — authentication + upload correlation: Logins by single-task accounts followed by file-upload API calls within a short time window: KQL: event_type=="auth_success" AND user_role=="single-task" | join kind=inner (event_type=="api_call" AND endpoint contains "upload") on user, session_id
  • Network telemetry (Zeek/Suricata): Alert on HTTP flows with unusually large POST bodies to vManage port 443 originating from IPs outside the defined admin network — threshold: body size > 1 MB from non-whitelisted sources.

Metrics

Severity
critical
Priority score
215.41
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
6.5
Source: nvd-v3
CVSS v3
6.5
CVSS v4
—
EPSS percentile
98.0 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
28.2 %
Elevated — model estimates 10-50% exploitation likelihood.
Published
2026-06-15 16:00 UTC
CWE
CWE-22

Weakness classes (CWE)

  • CWE-22Base

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

    cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Translated2026-07-23 11:10 UTC· nvd@nist.gov
    • Translation: Title: Cisco Catalyst SD-WAN Manager de Cisco, Description: Una vulnerabilidad en la interfaz de usuario web de Cisco Catalyst SD-WAN Manager, anteriormente SD-WAN vManage, podría permitir a un atacante remoto autenticado crear o sobrescribir cualquier archivo en el sistema de archivos de un sistema afectado. Esta vulnerabilidad existe porque el software afectado no valida correctamente la entrada proporcionada por el usuario durante un proceso de carga de archivos. Un atacante podría explotar esta vulnerabilidad enviando una solicitud HTTP manipulada a un endpoint de API afectado del sistema afectado. Un exploit exitoso podría permitir al atacante crear o sobrescribir cualquier archivo en el sistema operativo subyacente. Este archivo podría usarse posteriormente para escalar a root. Para explotar esta vulnerabilidad, el atacante debe tener credenciales válidas con al menos una cuenta de usuario de tarea única y con privilegios bajos.
  2. CVE CISA KEV Update2026-06-15 22:00 UTC· 9119a7d8-5eab-497f-8521-727c672e3725
    • Date Added: 2026-06-15
    • Due Date: 2026-06-15
    • Required Action: 2026-06-15
    • Vulnerability Name: 2026-06-15
  3. CVE Modified2026-06-15 21:16 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • Reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20262
  4. New CVE Received2026-06-15 18:16 UTC· psirt@cisco.com
    • Description: A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affected software does not properly validate user-supplied input during a file upload process. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected API endpoint of the affected system. A successful exploit could allow the attacker to create or overwrite any file on the underlying operating system. This file could later be used to elevate to root. To exploit this vulnerability, the attacker must have valid credentials with at least a lower-privileged, single-task user account.
    • CVSS V3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
    • CWE: CWE-22
    • Reference: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • cisco

    catalyst_sd-wan_manager20.10 – 20.12.7.2

  • cisco

    catalyst_sd-wan_manager20.13 – 20.15.4.5

  • cisco

    catalyst_sd-wan_manager20.15.5 – 20.15.5.3

  • cisco

    catalyst_sd-wan_manager20.16 – 20.18.3.1

  • cisco

    catalyst_sd-wan_manager26.1 – 26.1.1.2

  • cisco

    catalyst_sd-wan_manager20.9.9.2

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked advisories

IDCVE-2026-20262