CriticalCVE-2026-20262

Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability (CVE-2026-20262)

Published 15.06.2026Last modified 23.07.2026In CISA KEV since 15.06.2026Sources: CVE.org, Cisco PSIRT, BSI, SingCERT, pwn.watch

Actively exploited
Source: VulnCheck KEV (opens in a new tab), CSA/SingCERT How we classify
Public exploit

What is affected, what to do

The vulnerability is being actively exploited; treat it as a priority. Update catalyst_sd-wan_manager to version 26.1.1.2, SD-WAN to version 20.12.7.2. Immediate actions, mitigation and detection rules are in the runbook below.

Affected: Cisco Catalyst SD-WAN Manager eq 20.1.12..20.1.12
Cisco Catalyst SD-WAN Manager eq 19.2.1..19.2.1
Cisco Catalyst SD-WAN Manager eq 18.4.4..18.4.4
Cisco Catalyst SD-WAN Manager eq 18.4.5..18.4.5
Cisco Catalyst SD-WAN Manager eq 20.1.1.1..20.1.1.1
Cisco Catalyst SD-WAN Manager eq 20.1.1..20.1.1
Cisco Catalyst SD-WAN Manager eq 19.3.0..19.3.0
Cisco Catalyst SD-WAN Manager eq 19.2.2..19.2.2
Cisco Catalyst SD-WAN Manager eq 19.2.099..19.2.099
Cisco Catalyst SD-WAN Manager eq 18.3.6..18.3.6
Cisco Catalyst SD-WAN Manager eq 18.3.7..18.3.7
Cisco Catalyst SD-WAN Manager eq 19.2.0..19.2.0
Cisco Catalyst SD-WAN Manager eq 18.3.8..18.3.8
Cisco Catalyst SD-WAN Manager eq 19.0.0..19.0.0
Cisco Catalyst SD-WAN Manager eq 19.1.0..19.1.0
Cisco Catalyst SD-WAN Manager eq 18.4.302..18.4.302
Cisco Catalyst SD-WAN Manager eq 18.4.303..18.4.303
Cisco Catalyst SD-WAN Manager eq 19.2.097..19.2.097
Cisco Catalyst SD-WAN Manager eq 19.2.098..19.2.098
Cisco Catalyst SD-WAN Manager eq 17.2.10..17.2.10
Cisco Catalyst SD-WAN Manager eq 18.3.6.1..18.3.6.1
Cisco Catalyst SD-WAN Manager eq 19.0.1a..19.0.1a
Cisco Catalyst SD-WAN Manager eq 18.2.0..18.2.0
Cisco Catalyst SD-WAN Manager eq 18.4.3..18.4.3
Cisco Catalyst SD-WAN Manager eq 18.4.1..18.4.1
Cisco Catalyst SD-WAN Manager eq 17.2.8..17.2.8
Cisco Catalyst SD-WAN Manager eq 18.3.3.1..18.3.3.1
Cisco Catalyst SD-WAN Manager eq 18.4.0..18.4.0
Cisco Catalyst SD-WAN Manager eq 18.3.1..18.3.1
Cisco Catalyst SD-WAN Manager eq 17.2.6..17.2.6
Cisco Catalyst SD-WAN Manager eq 17.2.9..17.2.9
Cisco Catalyst SD-WAN Manager eq 18.3.4..18.3.4
Cisco Catalyst SD-WAN Manager eq 17.2.5..17.2.5
Cisco Catalyst SD-WAN Manager eq 18.3.1.1..18.3.1.1
Cisco Catalyst SD-WAN Manager eq 18.3.5..18.3.5
Cisco Catalyst SD-WAN Manager eq 18.4.0.1..18.4.0.1
Cisco Catalyst SD-WAN Manager eq 18.3.3..18.3.3
Cisco Catalyst SD-WAN Manager eq 17.2.7..17.2.7
Cisco Catalyst SD-WAN Manager eq 17.2.4..17.2.4
Cisco Catalyst SD-WAN Manager eq 18.3.0..18.3.0
Cisco Catalyst SD-WAN Manager eq 19.2.3..19.2.3
Cisco Catalyst SD-WAN Manager eq 18.4.501_ES..18.4.501_ES
Cisco Catalyst SD-WAN Manager eq 20.3.1..20.3.1
Cisco Catalyst SD-WAN Manager eq 20.1.2..20.1.2
Cisco Catalyst SD-WAN Manager eq 19.2.929..19.2.929
Cisco Catalyst SD-WAN Manager eq 19.2.31..19.2.31
Cisco Catalyst SD-WAN Manager eq 20.3.2..20.3.2
Cisco Catalyst SD-WAN Manager eq 19.2.32..19.2.32
Cisco Catalyst SD-WAN Manager eq 20.3.2_925..20.3.2_925
Cisco Catalyst SD-WAN Manager eq 20.3.2.1..20.3.2.1
Cisco Catalyst SD-WAN Manager eq 20.3.2.1_927..20.3.2.1_927
Cisco Catalyst SD-WAN Manager eq 18.4.6..18.4.6
Cisco Catalyst SD-WAN Manager eq 20.1.2_937..20.1.2_937
Cisco Catalyst SD-WAN Manager eq 20.4.1..20.4.1
Cisco Catalyst SD-WAN Manager eq 20.3.2_928..20.3.2_928
Cisco Catalyst SD-WAN Manager eq 20.3.2_929..20.3.2_929
Cisco Catalyst SD-WAN Manager eq 20.4.1.0.1..20.4.1.0.1
Cisco Catalyst SD-WAN Manager eq 20.3.2.1_930..20.3.2.1_930
Cisco Catalyst SD-WAN Manager eq 19.2.4..19.2.4
Cisco Catalyst SD-WAN Manager eq 20.5.0.1.1..20.5.0.1.1
Cisco Catalyst SD-WAN Manager eq 20.4.1.1..20.4.1.1
Cisco Catalyst SD-WAN Manager eq 20.3.3..20.3.3
Cisco Catalyst SD-WAN Manager eq 19.2.4.0.1..19.2.4.0.1
Cisco Catalyst SD-WAN Manager eq 20.3.2_937..20.3.2_937
Cisco Catalyst SD-WAN Manager eq 20.3.3.1..20.3.3.1
Cisco Catalyst SD-WAN Manager eq 20.5.1..20.5.1
Cisco Catalyst SD-WAN Manager eq 20.1.3..20.1.3
Cisco Catalyst SD-WAN Manager eq 20.3.3.0.4..20.3.3.0.4
Cisco Catalyst SD-WAN Manager eq 20.3.3.1.2..20.3.3.1.2
Cisco Catalyst SD-WAN Manager eq 20.3.3.1.1..20.3.3.1.1
Cisco Catalyst SD-WAN Manager eq 20.4.1.2..20.4.1.2
Cisco Catalyst SD-WAN Manager eq 20.3.3.0.2..20.3.3.0.2
Cisco Catalyst SD-WAN Manager eq 20.4.1.1.5..20.4.1.1.5
Cisco Catalyst SD-WAN Manager eq 20.4.1.0.01..20.4.1.0.01
Cisco Catalyst SD-WAN Manager eq 20.4.1.0.02..20.4.1.0.02
Cisco Catalyst SD-WAN Manager eq 20.3.3.1.7..20.3.3.1.7
Cisco Catalyst SD-WAN Manager eq 20.3.3.1.5..20.3.3.1.5
Cisco Catalyst SD-WAN Manager eq 20.5.1.0.1..20.5.1.0.1
Cisco Catalyst SD-WAN Manager eq 20.3.3.1.10..20.3.3.1.10
Cisco Catalyst SD-WAN Manager eq 20.3.3.0.8..20.3.3.0.8
Cisco Catalyst SD-WAN Manager eq 20.4.2..20.4.2
Cisco Catalyst SD-WAN Manager eq 20.4.2.0.1..20.4.2.0.1
Cisco Catalyst SD-WAN Manager eq 20.3.4..20.3.4
Cisco Catalyst SD-WAN Manager eq 20.3.3.0.14..20.3.3.0.14
Cisco Catalyst SD-WAN Manager eq 19.2.4.0.8..19.2.4.0.8
Cisco Catalyst SD-WAN Manager eq 19.2.4.0.9..19.2.4.0.9
Cisco Catalyst SD-WAN Manager eq 20.3.4.0.1..20.3.4.0.1
Cisco Catalyst SD-WAN Manager eq 20.3.2.0.5..20.3.2.0.5
Cisco Catalyst SD-WAN Manager eq 20.6.1..20.6.1
Cisco Catalyst SD-WAN Manager eq 20.5.1.0.2..20.5.1.0.2
Cisco Catalyst SD-WAN Manager eq 20.3.3.0.17..20.3.3.0.17
Cisco Catalyst SD-WAN Manager eq 20.6.1.1..20.6.1.1
Cisco Catalyst SD-WAN Manager eq 20.6.0.18.3..20.6.0.18.3
Cisco Catalyst SD-WAN Manager eq 20.3.2.0.6..20.3.2.0.6
Cisco Catalyst SD-WAN Manager eq 20.6.0.18.4..20.6.0.18.4
Cisco Catalyst SD-WAN Manager eq 20.4.2.0.2..20.4.2.0.2
Cisco Catalyst SD-WAN Manager eq 20.3.3.0.16..20.3.3.0.16
Cisco Catalyst SD-WAN Manager eq 20.3.4.0.5..20.3.4.0.5
Cisco Catalyst SD-WAN Manager eq 20.6.1.0.1..20.6.1.0.1
Cisco Catalyst SD-WAN Manager eq 20.3.4.0.6..20.3.4.0.6
Cisco Catalyst SD-WAN Manager eq 20.6.2..20.6.2
Cisco Catalyst SD-WAN Manager eq 20.7.1EFT2..20.7.1EFT2
Cisco Catalyst SD-WAN Manager eq 20.3.4.0.9..20.3.4.0.9
Cisco Catalyst SD-WAN Manager eq 20.3.4.0.11..20.3.4.0.11
Cisco Catalyst SD-WAN Manager eq 20.4.2.0.4..20.4.2.0.4
Cisco Catalyst SD-WAN Manager eq 20.3.3.0.18..20.3.3.0.18
Cisco Catalyst SD-WAN Manager eq 20.7.1..20.7.1
Cisco Catalyst SD-WAN Manager eq 20.6.2.1..20.6.2.1
Cisco Catalyst SD-WAN Manager eq 20.3.4.1..20.3.4.1
Cisco Catalyst SD-WAN Manager eq 20.5.1.1..20.5.1.1
Cisco Catalyst SD-WAN Manager eq 20.4.2.1..20.4.2.1
Cisco Catalyst SD-WAN Manager eq 20.4.2.1.1..20.4.2.1.1
Cisco Catalyst SD-WAN Manager eq 20.3.4.1.1..20.3.4.1.1
Cisco Catalyst SD-WAN Manager eq 20.3.813..20.3.813
Cisco Catalyst SD-WAN Manager eq 20.3.4.0.19..20.3.4.0.19
Cisco Catalyst SD-WAN Manager eq 20.4.2.2.1..20.4.2.2.1
Cisco Catalyst SD-WAN Manager eq 20.5.1.2..20.5.1.2
Cisco Catalyst SD-WAN Manager eq 20.3.4.2..20.3.4.2
Cisco Catalyst SD-WAN Manager eq 20.3.814..20.3.814
Cisco Catalyst SD-WAN Manager eq 20.4.2.2..20.4.2.2
Cisco Catalyst SD-WAN Manager eq 20.6.2.2..20.6.2.2
Cisco Catalyst SD-WAN Manager eq 20.3.4.2.1..20.3.4.2.1
Cisco Catalyst SD-WAN Manager eq 20.7.1.1..20.7.1.1
Cisco Catalyst SD-WAN Manager eq 20.3.4.1.2..20.3.4.1.2
Cisco Catalyst SD-WAN Manager eq 20.6.2.2.2..20.6.2.2.2
Cisco Catalyst SD-WAN Manager eq 20.3.4.0.20..20.3.4.0.20
Cisco Catalyst SD-WAN Manager eq 20.6.2.2.3..20.6.2.2.3
Cisco Catalyst SD-WAN Manager eq 20.4.2.2.2..20.4.2.2.2
Cisco Catalyst SD-WAN Manager eq 20.3.5..20.3.5
Cisco Catalyst SD-WAN Manager eq 20.6.2.0.4..20.6.2.0.4
Cisco Catalyst SD-WAN Manager eq 20.4.2.2.3..20.4.2.2.3
Cisco Catalyst SD-WAN Manager eq 20.3.4.0.24..20.3.4.0.24
Cisco Catalyst SD-WAN Manager eq 20.6.2.2.7..20.6.2.2.7
Cisco Catalyst SD-WAN Manager eq 20.6.3..20.6.3
Cisco Catalyst SD-WAN Manager eq 20.3.4.2.2..20.3.4.2.2
Cisco Catalyst SD-WAN Manager eq 20.4.2.2.4..20.4.2.2.4
Cisco Catalyst SD-WAN Manager eq 20.7.1.0.2..20.7.1.0.2
Cisco Catalyst SD-WAN Manager eq 20.8.1..20.8.1
Cisco Catalyst SD-WAN Manager eq 20.3.5.0.8..20.3.5.0.8
Cisco Catalyst SD-WAN Manager eq 20.3.5.0.9..20.3.5.0.9
Cisco Catalyst SD-WAN Manager eq 20.4.2.2.8..20.4.2.2.8
Cisco Catalyst SD-WAN Manager eq 20.3.5.0.7..20.3.5.0.7
Cisco Catalyst SD-WAN Manager eq 20.6.3.0.7..20.6.3.0.7
Cisco Catalyst SD-WAN Manager eq 20.6.3.0.5..20.6.3.0.5
Cisco Catalyst SD-WAN Manager eq 20.6.3.0.10..20.6.3.0.10
Cisco Catalyst SD-WAN Manager eq 20.6.3.0.2..20.6.3.0.2
Cisco Catalyst SD-WAN Manager eq 20.7.2..20.7.2
Cisco Catalyst SD-WAN Manager eq 20.9.1EFT2..20.9.1EFT2
Cisco Catalyst SD-WAN Manager eq 20.6.3.0.11..20.6.3.0.11
Cisco Catalyst SD-WAN Manager eq 20.6.3.1..20.6.3.1
Cisco Catalyst SD-WAN Manager eq 20.6.3.0.14..20.6.3.0.14
Cisco Catalyst SD-WAN Manager eq 20.6.4..20.6.4
Cisco Catalyst SD-WAN Manager eq 20.9.1..20.9.1
Cisco Catalyst SD-WAN Manager eq 20.6.3.0.19..20.6.3.0.19
Cisco Catalyst SD-WAN Manager eq 20.6.3.0.18..20.6.3.0.18
Cisco Catalyst SD-WAN Manager eq 20.3.6..20.3.6
Cisco Catalyst SD-WAN Manager eq 20.9.1.1..20.9.1.1
Cisco Catalyst SD-WAN Manager eq 20.6.3.0.23..20.6.3.0.23
Cisco Catalyst SD-WAN Manager eq 20.6.4.0.4..20.6.4.0.4
Cisco Catalyst SD-WAN Manager eq 20.6.3.0.25..20.6.3.0.25
Cisco Catalyst SD-WAN Manager eq 20.6.5..20.6.5
Cisco Catalyst SD-WAN Manager eq 20.6.3.0.27..20.6.3.0.27
Cisco Catalyst SD-WAN Manager eq 20.9.2..20.9.2
Cisco Catalyst SD-WAN Manager eq 20.9.2.1..20.9.2.1
Cisco Catalyst SD-WAN Manager eq 20.6.3.0.29..20.6.3.0.29
Cisco Catalyst SD-WAN Manager eq 20.6.3.0.31..20.6.3.0.31
Cisco Catalyst SD-WAN Manager eq 20.6.3.0.32..20.6.3.0.32
Cisco Catalyst SD-WAN Manager eq 20.10.1..20.10.1
Cisco Catalyst SD-WAN Manager eq 20.6.3.0.33..20.6.3.0.33
Cisco Catalyst SD-WAN Manager eq 20.9.2.0.01..20.9.2.0.01
Cisco Catalyst SD-WAN Manager eq 20.9.1_LI_Images..20.9.1_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.10.1_LI_Images..20.10.1_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.9.2_LI_Images..20.9.2_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.3.7..20.3.7
Cisco Catalyst SD-WAN Manager eq 20.9.3..20.9.3
Cisco Catalyst SD-WAN Manager eq 20.6.5.1..20.6.5.1
Cisco Catalyst SD-WAN Manager eq 20.11.1..20.11.1
Cisco Catalyst SD-WAN Manager eq 20.11.1_LI_Images..20.11.1_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.9.3_LI_ Images..20.9.3_LI_ Images
Cisco Catalyst SD-WAN Manager eq 20.6.3.1.1..20.6.3.1.1
Cisco Catalyst SD-WAN Manager eq 20.9.3.0.2..20.9.3.0.2
Cisco Catalyst SD-WAN Manager eq 20.6.5.1.2..20.6.5.1.2
Cisco Catalyst SD-WAN Manager eq 20.9.3.0.3..20.9.3.0.3
Cisco Catalyst SD-WAN Manager eq 20.4.2.3..20.4.2.3
Cisco Catalyst SD-WAN Manager eq 20.6.3.2..20.6.3.2
Cisco Catalyst SD-WAN Manager eq 20.6.4.1..20.6.4.1
Cisco Catalyst SD-WAN Manager eq 20.6.3.0.38..20.6.3.0.38
Cisco Catalyst SD-WAN Manager eq 20.6.3.0.39..20.6.3.0.39
Cisco Catalyst SD-WAN Manager eq 20.3.5.1..20.3.5.1
Cisco Catalyst SD-WAN Manager eq 20.3.4.3..20.3.4.3
Cisco Catalyst SD-WAN Manager eq 20.9.3.1..20.9.3.1
Cisco Catalyst SD-WAN Manager eq 20.3.3.2..20.3.3.2
Cisco Catalyst SD-WAN Manager eq 20.6.5.2..20.6.5.2
Cisco Catalyst SD-WAN Manager eq 20.3.7.1..20.3.7.1
Cisco Catalyst SD-WAN Manager eq 20.10.1.1..20.10.1.1
Cisco Catalyst SD-WAN Manager eq 20.6.5.2.1..20.6.5.2.1
Cisco Catalyst SD-WAN Manager eq 20.3.4.0.25..20.3.4.0.25
Cisco Catalyst SD-WAN Manager eq 20.6.2.2.4..20.6.2.2.4
Cisco Catalyst SD-WAN Manager eq 20.6.1.2..20.6.1.2
Cisco Catalyst SD-WAN Manager eq 20.11.1.1..20.11.1.1
Cisco Catalyst SD-WAN Manager eq 20.9.3.0.5..20.9.3.0.5
Cisco Catalyst SD-WAN Manager eq 20.3.4.0.26..20.3.4.0.26
Cisco Catalyst SD-WAN Manager eq 20.6.5.1.3..20.6.5.1.3
Cisco Catalyst SD-WAN Manager eq 20.6.3.0.40..20.6.3.0.40
Cisco Catalyst SD-WAN Manager eq 20.1.3.1..20.1.3.1
Cisco Catalyst SD-WAN Manager eq 20.9.2.2..20.9.2.2
Cisco Catalyst SD-WAN Manager eq 20.6.5.2.3..20.6.5.2.3
Cisco Catalyst SD-WAN Manager eq 20.6.5.1.4..20.6.5.1.4
Cisco Catalyst SD-WAN Manager eq 20.6.5.3..20.6.5.3
Cisco Catalyst SD-WAN Manager eq 20.6.3.0.41..20.6.3.0.41
Cisco Catalyst SD-WAN Manager eq 20.9.3.0.7..20.9.3.0.7
Cisco Catalyst SD-WAN Manager eq 20.6.5.1.5..20.6.5.1.5
Cisco Catalyst SD-WAN Manager eq 20.9.3.0.4..20.9.3.0.4
Cisco Catalyst SD-WAN Manager eq 20.6.4.0.19..20.6.4.0.19
Cisco Catalyst SD-WAN Manager eq 20.6.5.1.6..20.6.5.1.6
Cisco Catalyst SD-WAN Manager eq 20.9.3.0.8..20.9.3.0.8
Cisco Catalyst SD-WAN Manager eq 20.6.3.3..20.6.3.3
Cisco Catalyst SD-WAN Manager eq 20.3.7.2..20.3.7.2
Cisco Catalyst SD-WAN Manager eq 20.6.5.4..20.6.5.4
Cisco Catalyst SD-WAN Manager eq 20.6.5.1.7..20.6.5.1.7
Cisco Catalyst SD-WAN Manager eq 20.9.3.0.12..20.9.3.0.12
Cisco Catalyst SD-WAN Manager eq 20.6.4.2..20.6.4.2
Cisco Catalyst SD-WAN Manager eq 20.6.5.5..20.6.5.5
Cisco Catalyst SD-WAN Manager eq 20.9.3.2..20.9.3.2
Cisco Catalyst SD-WAN Manager eq 20.11.1.2..20.11.1.2
Cisco Catalyst SD-WAN Manager eq 20.6.3.4..20.6.3.4
Cisco Catalyst SD-WAN Manager eq 20.10.1.2..20.10.1.2
Cisco Catalyst SD-WAN Manager eq 20.6.5.1.9..20.6.5.1.9
Cisco Catalyst SD-WAN Manager eq 20.9.3.0.16..20.9.3.0.16
Cisco Catalyst SD-WAN Manager eq 20.6.3.0.45..20.6.3.0.45
Cisco Catalyst SD-WAN Manager eq 20.6.5.1.10..20.6.5.1.10
Cisco Catalyst SD-WAN Manager eq 20.9.3.0.17..20.9.3.0.17
Cisco Catalyst SD-WAN Manager eq 20.6.5.2.4..20.6.5.2.4
Cisco Catalyst SD-WAN Manager eq 20.6.4.0.21..20.6.4.0.21
Cisco Catalyst SD-WAN Manager eq 20.9.3.0.18..20.9.3.0.18
Cisco Catalyst SD-WAN Manager eq 20.6.3.0.46..20.6.3.0.46
Cisco Catalyst SD-WAN Manager eq 20.6.3.0.47..20.6.3.0.47
Cisco Catalyst SD-WAN Manager eq 20.9.2.3..20.9.2.3
Cisco Catalyst SD-WAN Manager eq 20.9.3.2_LI_Images..20.9.3.2_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.9.3.0.21..20.9.3.0.21
Cisco Catalyst SD-WAN Manager eq 20.9.3.0.20..20.9.3.0.20
Cisco Catalyst SD-WAN Manager eq 20.9.4_LI_Images..20.9.4_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.9.4..20.9.4
Cisco Catalyst SD-WAN Manager eq 20.6.5.1.11..20.6.5.1.11
Cisco Catalyst SD-WAN Manager eq 20.12.1..20.12.1
Cisco Catalyst SD-WAN Manager eq 20.12.1_LI_Images..20.12.1_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.6.5.1.13..20.6.5.1.13
Cisco Catalyst SD-WAN Manager eq 20.9.3.0.23..20.9.3.0.23
Cisco Catalyst SD-WAN Manager eq 20.6.5.2.8..20.6.5.2.8
Cisco Catalyst SD-WAN Manager eq 20.9.4.1..20.9.4.1
Cisco Catalyst SD-WAN Manager eq 20.9.4.1_LI_Images..20.9.4.1_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.9.3.0.25..20.9.3.0.25
Cisco Catalyst SD-WAN Manager eq 20.9.3.0.24..20.9.3.0.24
Cisco Catalyst SD-WAN Manager eq 20.6.5.1.14..20.6.5.1.14
Cisco Catalyst SD-WAN Manager eq 20.3.8..20.3.8
Cisco Catalyst SD-WAN Manager eq 20.6.6..20.6.6
Cisco Catalyst SD-WAN Manager eq 20.9.3.0.26..20.9.3.0.26
Cisco Catalyst SD-WAN Manager eq 20.6.3.0.51..20.6.3.0.51
Cisco Catalyst SD-WAN Manager eq 20.9.3.0.29..20.9.3.0.29
Cisco Catalyst SD-WAN Manager eq 20.12.2..20.12.2
Cisco Catalyst SD-WAN Manager eq 20.12.2_LI_Images..20.12.2_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.6.6.0.1..20.6.6.0.1
Cisco Catalyst SD-WAN Manager eq 20.13.1_LI_Images..20.13.1_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.9.4.0.4..20.9.4.0.4
Cisco Catalyst SD-WAN Manager eq 20.13.1..20.13.1
Cisco Catalyst SD-WAN Manager eq 20.9.4.1.1..20.9.4.1.1
Cisco Catalyst SD-WAN Manager eq 20.9.5..20.9.5
Cisco Catalyst SD-WAN Manager eq 20.9.5_LI_Images..20.9.5_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.12.3_LI_Images..20.12.3_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.12.3..20.12.3
Cisco Catalyst SD-WAN Manager eq 20.9.4.1.3..20.9.4.1.3
Cisco Catalyst SD-WAN Manager eq 20.6.7..20.6.7
Cisco Catalyst SD-WAN Manager eq 20.9.5.1..20.9.5.1
Cisco Catalyst SD-WAN Manager eq 20.9.5.1_LI_Images..20.9.5.1_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.9.4.1.6..20.9.4.1.6
Cisco Catalyst SD-WAN Manager eq 20.14.1..20.14.1
Cisco Catalyst SD-WAN Manager eq 20.14.1_LI_Images..20.14.1_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.9.5.2..20.9.5.2
Cisco Catalyst SD-WAN Manager eq 20.9.5.2.1..20.9.5.2.1
Cisco Catalyst SD-WAN Manager eq 20.9.5.2_LI_Images..20.9.5.2_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.12.3.1..20.12.3.1
Cisco Catalyst SD-WAN Manager eq 20.12.4..20.12.4
Cisco Catalyst SD-WAN Manager eq 20.15.1_LI_Images..20.15.1_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.15.1..20.15.1
Cisco Catalyst SD-WAN Manager eq 20.9.5.1.4..20.9.5.1.4
Cisco Catalyst SD-WAN Manager eq 20.9.5.2.7..20.9.5.2.7
Cisco Catalyst SD-WAN Manager eq 20.9.5.2.13..20.9.5.2.13
Cisco Catalyst SD-WAN Manager eq 20.9.6..20.9.6
Cisco Catalyst SD-WAN Manager eq 20.9.6_LI_Images..20.9.6_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.9.5.2.14..20.9.5.2.14
Cisco Catalyst SD-WAN Manager eq 20.6.8..20.6.8
Cisco Catalyst SD-WAN Manager eq 20.12.4.0.03..20.12.4.0.03
Cisco Catalyst SD-WAN Manager eq 20.16.1..20.16.1
Cisco Catalyst SD-WAN Manager eq 20.16.1_LI_Images..20.16.1_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.12.4_LI_Images..20.12.4_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.9.5.2.16..20.9.5.2.16
Cisco Catalyst SD-WAN Manager eq 20.12.4.0.4..20.12.4.0.4
Cisco Catalyst SD-WAN Manager eq 20.12.401..20.12.401
Cisco Catalyst SD-WAN Manager eq 20.9.5.3..20.9.5.3
Cisco Catalyst SD-WAN Manager eq 20.9.5.3_LI_Images..20.9.5.3_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.12.4.1_LI_Images..20.12.4.1_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.12.4.1..20.12.4.1
Cisco Catalyst SD-WAN Manager eq 20.9.5.2.21..20.9.5.2.21
Cisco Catalyst SD-WAN Manager eq 20.9.6.0.3..20.9.6.0.3
Cisco Catalyst SD-WAN Manager eq 20.12.4.0.6..20.12.4.0.6
Cisco Catalyst SD-WAN Manager eq 20.15.2_LI_Images..20.15.2_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.15.2..20.15.2
Cisco Catalyst SD-WAN Manager eq 20.12.4_Monthly_ES5..20.12.4_Monthly_ES5
Cisco Catalyst SD-WAN Manager eq 20.12.5..20.12.5
Cisco Catalyst SD-WAN Manager eq 20.12.5_LI_Images..20.12.5_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.9.7_LI _Images..20.9.7_LI _Images
Cisco Catalyst SD-WAN Manager eq 20.9.7..20.9.7
Cisco Catalyst SD-WAN Manager eq 20.15.3..20.15.3
Cisco Catalyst SD-WAN Manager eq 20.15.3_ LI _Images..20.15.3_ LI _Images
Cisco Catalyst SD-WAN Manager eq 20.12.501..20.12.501
Cisco Catalyst SD-WAN Manager eq 20.12.5.1_LI_Images..20.12.5.1_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.12.5.1..20.12.5.1
Cisco Catalyst SD-WAN Manager eq 20.12.5.2_LI_Images..20.12.5.2_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.12.5.2..20.12.5.2
Cisco Catalyst SD-WAN Manager eq 20.15.3.1..20.15.3.1
Cisco Catalyst SD-WAN Manager eq 20.15.4_LI_Images..20.15.4_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.15.4..20.15.4
Cisco Catalyst SD-WAN Manager eq 20.9.7.1_LI _Images..20.9.7.1_LI _Images
Cisco Catalyst SD-WAN Manager eq 20.9.7.1..20.9.7.1
Cisco Catalyst SD-WAN Manager eq 20.18.1..20.18.1
Cisco Catalyst SD-WAN Manager eq 20.18.1_LI_Images..20.18.1_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.12.6_LI_Images..20.12.6_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.12.6..20.12.6
Cisco Catalyst SD-WAN Manager eq 20.12.5.1.01..20.12.5.1.01
Cisco Catalyst SD-WAN Manager eq 26.0.1..26.0.1
Cisco Catalyst SD-WAN Manager eq 20.9.8..20.9.8
Cisco Catalyst SD-WAN Manager eq 20.9.8_LI_Images..20.9.8_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.18.2..20.18.2
Cisco Catalyst SD-WAN Manager eq 20.15.4.1_LI_Images..20.15.4.1_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.15.4.1..20.15.4.1
Cisco Catalyst SD-WAN Manager eq 20.18.2_LI_Images..20.18.2_LI_Images
Cisco Catalyst SD-WAN Manager eq 26.1.1..26.1.1
Cisco Catalyst SD-WAN Manager eq 26.1.1_LI_Images..26.1.1_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.18.2.1_LI_Images..20.18.2.1_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.18.2.1..20.18.2.1
Cisco Catalyst SD-WAN Manager eq 20.15.4.2_LI_Images..20.15.4.2_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.15.4.2..20.15.4.2
Cisco Catalyst SD-WAN Manager eq 20.12.6.1..20.12.6.1
Cisco Catalyst SD-WAN Manager eq 20.12.6.1_LI_Images..20.12.6.1_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.12.5.3..20.12.5.3
Cisco Catalyst SD-WAN Manager eq 20.12.5.3_LI_Images..20.12.5.3_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.9.8.2_LI_Images..20.9.8.2_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.9.8.2..20.9.8.2
Cisco Catalyst SD-WAN Manager eq 20.18.3..20.18.3
Cisco Catalyst SD-WAN Manager eq 20.18.3_LI_Images..20.18.3_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.15.5..20.15.5
Cisco Catalyst SD-WAN Manager eq 20.15.5_LI_Images..20.15.5_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.12.7..20.12.7
Cisco Catalyst SD-WAN Manager eq 20.12.7_LI_Images..20.12.7_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.9.9..20.9.9
Cisco Catalyst SD-WAN Manager eq 20.9.9_LI_Images..20.9.9_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.18.2.2..20.18.2.2
Cisco Catalyst SD-WAN Manager eq 20.18.2.2_LI_Images..20.18.2.2_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.12.5.4..20.12.5.4
Cisco Catalyst SD-WAN Manager eq 20.12.5.4_LI_ Images..20.12.5.4_LI_ Images
Cisco Catalyst SD-WAN Manager eq 20.12.7.1_LI_Images..20.12.7.1_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.12.6.2_LI_Images..20.12.6.2_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.12.7.1..20.12.7.1
Cisco Catalyst SD-WAN Manager eq 20.15.5.1..20.15.5.1
Cisco Catalyst SD-WAN Manager eq 20.15.4.3..20.15.4.3
Cisco Catalyst SD-WAN Manager eq 20.15.4.3_LI_Images..20.15.4.3_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.15.5.1_LI_Images..20.15.5.1_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.12.6.2..20.12.6.2
Cisco Catalyst SD-WAN Manager eq 20.15.5.2..20.15.5.2
Cisco Catalyst SD-WAN Manager eq 20.15.5.2_LI_Images..20.15.5.2_LI_Images
Cisco Catalyst SD-WAN Manager eq 26.1.1.1_LI_Images..26.1.1.1_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.15.4.4..20.15.4.4
Cisco Catalyst SD-WAN Manager eq 20.15.4.4_LI_Images..20.15.4.4_LI_Images
Cisco Catalyst SD-WAN Manager eq 26.1.1.1..26.1.1.1
Cisco Catalyst SD-WAN Manager eq 20.9.9.1_LI_Images..20.9.9.1_LI_Images
Cisco Catalyst SD-WAN Manager eq 20.9.9.1..20.9.9.1

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

6.5

Priority

XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

Source: NVD, CVSS v3

6.5

CVSS v3

Severity Medium on the scale from 0 to 10.

Source: CVE.org, Cisco PSIRT, BSI, SingCERT, pwn.watch

29.1 %

EPSS score

Elevated — model estimates 10-50% exploitation likelihood.

Source: FIRST EPSS, percentile 98.2

Show all metrics

Severity: Critical
Priority (0–325) The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first? Read in glossary: 228.63 Methodology
Exploit maturity An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack. Read in glossary: actively exploitedSource: VulnCheck KEV (opens in a new tab), CSA/SingCERT How we classify
XIEM Effective CVSS XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command. Read in glossary: 6.5 Methodology
CVSS v3 CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions. Read in glossary: 6.5
EPSS score The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“. Read in glossary: 29.1 %; Elevated — model estimates 10-50% exploitation likelihood.
EPSS percentile The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking. Read in glossary: 98.2; Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
KEV status The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching. Read in glossary: Actively exploited
Published: 15.06.2026
In CISA KEV since The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching. Read in glossary: 15.06.2026
CWE CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect. Read in glossary: CWE-22

Response and mitigation

Why act now?

Prioritisation rationale

The flaw is network-reachable with low complexity and needs only a low-privilege account. According to the vendor, arbitrary file overwrite leads to root, which hands the attacker the central controller that pushes configuration and policy to every SD-WAN edge. Exploitation likelihood ranks among the highest of all scored CVEs. CISA does not flag ransomware use, and the typical objective is persistent, stealthy access to network infrastructure at service providers, government bodies and critical-infrastructure operators. If your Manager is reachable from the internet or broad internal networks, or carries many weakly protected accounts, treat this as critical despite its moderate base severity and patch or isolate within 24 hours. If access is tightly segmented and MFA-protected, an expedited emergency change window is defensible.

01
Runbook step 1
Immediate response (0-24 h)
- Inventory first: Locate every Cisco Catalyst SD-WAN Manager (formerly vManage) instance, including cluster nodes, and check versions. Affected per context are 18.4.4, 18.4.5, 19.2.1, 19.2.2, 19.3.0, 20.1.1, 20.1.1.1 and 20.1.12. These are older trains that may be out of standard support, so validate the upgrade path before the maintenance window.
- Patch: A patch is available from the vendor. Look up the fixed release in the Cisco Security Advisory for CVE-2026-20262. Migrate to the recommended release while respecting controller (vSmart/vBond) and edge compatibility.
- Lock down web UI/API exposure now: Block the management HTTPS interface (typically TCP 443/8443) from the internet and from user VLANs. Allow access only from dedicated admin jump hosts.
- Clean up accounts: Audit all local and RADIUS/TACACS-backed users, especially single-task and low-privilege accounts. Disable anything unneeded and rotate passwords on the rest. One usable account is all the attacker needs.
- Check for compromise before patching: Preserve a snapshot or admin-tech bundle so the upgrade does not destroy evidence. Then hunt for unexpected files, new root persistence and foreign SSH keys (see Detection rules).
- If indicators are found: Isolate the Manager, engage Cisco TAC and plan a rebuild from a trusted image. Patching does not remove root persistence that is already in place. Assess NIS2 reporting obligations (24-hour early warning).
02
Runbook step 2
Mitigation layers
- Network segmentation: Place the SD-WAN management plane in a dedicated management VLAN/VRF. Use ACLs that permit only admin-network source IPs to the Manager's HTTPS ports, and log and drop everything else.
- WAF/reverse proxy/IPS: Where a fronting proxy is feasible, inspect file-upload API requests. Block any request whose filename= field in multipart/form-data contains ../, ..%2f, %2e%2e%2f, ..\ or absolute paths (/etc/, /root/, /home/). For Suricata, build a signature on http.request_body/file.name with pcre:"/filename=\"[^\"]*(\.\.\/|%2e%2e)/i".
- IAM/least privilege: Minimise the number of accounts with web UI access. Enforce MFA through an external IdP or RADIUS/TACACS+ with a second factor, and eliminate shared service accounts.
- Host hardening: Monitor integrity of critical paths where the platform permits. Otherwise, regularly diff filesystem and configuration baselines from admin-tech exports.
- Centralise logging: Forward Manager syslog and audit logs to the SIEM so evidence survives a root-level compromise.
03
Runbook step 3
Detection rules
- Web/API logs (reverse proxy or Manager logs, typically under /var/log/nms/): Hunt for POST/PUT requests to upload endpoints that contain traversal sequences. Example SPL: index=sdwan (method=POST OR method=PUT) ("../" OR "%2e%2e" OR "..%2f") | stats count by src_ip, user, uri.
- Manager audit log: Watch for file, template or software uploads by single-task or low-privilege users, and for logins by such accounts from new source IPs or outside business hours. Sigma shape: logsource: cisco_sdwan_audit, selection: user_role|contains: 'single-task' AND action|contains: 'upload'.
- Filesystem artefacts (forensic or admin-tech export): Any of the following points to compromise:
  
  new or modified files in /etc/cron*, /etc/passwd, /etc/sudoers*, /root/.ssh/authorized_keys or /home/*/.ssh/authorized_keys;
  
  unexpected scripts in startup paths;
  
  files whose timestamps align with suspicious upload requests.
- Process and account anomalies: Unknown local users, new root shells, vshell sessions without a change ticket, and downgrade or reboot events outside maintenance windows.
- Network telemetry (Zeek/NetFlow): Outbound connections from the Manager to unfamiliar external hosts, especially SSH, HTTP downloads or long-lived TLS sessions that do not belong to Cisco cloud services or known controllers. Example KQL: CommonSecurityLog | where SourceIP in (vmanage_ips) and DestinationIP !in (known_dst) | summarize count() by DestinationIP, DestinationPort.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2 NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management. Read in glossary: Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
CRA The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates. Read in glossary: Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
ISO/IEC 27001 ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security. Read in glossary: Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affected software does not properly validate user-supplied input during a file upload process. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected API endpoint of the affected system. A successful exploit could allow the attacker to create or overwrite any file on the underlying operating system. This file could later be used to elevate to root. To exploit this vulnerability, the attacker must have valid credentials with at least a lower-privileged, single-task user account.

Source: CISA KEV Catalog, NVD (NIST), cvelistv5, cisco_csaf, BSI CSAF, BSI WID Portal, CSA/SingCERT, pwn.watch

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

Affected products
		Affected versions	Fixed in
Cisco	Cisco Catalyst SD-WAN Manager	`20.3.3.0.4` `20.9.4.1_LI_Images` `20.3.3.0.8` `20.9.3.0.17` `20.9.1.1` `18.4.1` `20.8.1` `20.12.4.0.03` `19.3.0` `20.3.4.0.24` `20.3.4.0.20` `20.15.4.1_LI_Images` `19.2.1` `20.4.2.2.8` `20.12.2` `20.9.3.0.12` `20.15.4.4` `20.10.1_LI_Images` `20.3.2.0.5` `20.3.2_929` `18.4.4` `20.3.4.0.6` `17.2.8` `18.4.5` `20.9.3.0.24` `20.18.1_LI_Images` `26.1.1` `20.11.1.2` `20.3.5.0.7` `20.3.4.0.9` `20.18.2.2` `20.9.3.0.23` `18.3.1` `20.12.5_LI_Images` `20.6.6` `20.6.5.1.3` `20.9.2.0.01` `20.9.3.0.18` `20.9.3.0.3` `20.5.1.0.2` `20.6.7` `20.6.5.1` `20.3.8` `26.0.1` `20.12.401` `20.15.1` `18.4.0` `20.6.3.0.46`	— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

Vendors and products

Weakness classes (CWE)

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Base
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Entry at MITRE CWE-22

Public exploit references

Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

Public exploit references

CISA KEV Catalog	CISA Known Exploited Vulnerability (opens in a new tab)cisa.gov	actively exploited	15.06.2026
CSA/SingCERT	Vulnerability in Cisco Catalyst SD-WAN Manager (opens in a new tab)CSA/SingCERT	actively exploited	15.06.2026
PoC-in-GitHub (nomi-sec)	CVE-2026-20262-Cisco-Catalyst-SD-WAN-Manager-Arbitrary-File-Write- (opens in a new tab)github.com	PoC (publicly reported)reported, not verified	18.06.2026
PoC-in-GitHub (nomi-sec)	CVE-2026-20262 (opens in a new tab)github.com	PoC (publicly reported)reported, not verified	16.06.2026

References & sources

sec.cloudapps.cisco.comcisco-sa-sdwan-arbfw-c2rZvQpwn-watch
cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20262government-resource
pwn.watchpwn.watch: Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerabilitypwn-watch
NVD (NIST)NVD: CVE-2026-20262pwn-watch
cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

15.06.2026CISA KEV entry updated9119a7d8…
4 individual changes: Date Added, Due Date, Required Action, Vulnerability Name
Show 4 original changes
Individual changes of this event as published by NVD
Type Action Before After
Date Added added
—
2026-06-15
Due Date added
—
2026-06-15
Required Action added
—
2026-06-15
Vulnerability Name added
—
2026-06-15
Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725
15.06.2026Record modifiedCISA ADP
New references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20262
Show the original change
Individual changes of this event as published by NVD
Type Action Before After
Reference added
—
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20262
Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Individual changes of this event as published by NVD
Type	Action	Before	After
Date Added	added	—	2026-06-15
Due Date	added	—	2026-06-15
Required Action	added	—	2026-06-15
Vulnerability Name	added	—	2026-06-15

Individual changes of this event as published by NVD
Type	Action	Before	After
Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20262

15.06.2026ReceivedCisco

CVSS V3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness type: CWE-22

Description added or changed

New references:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ

Show 4 original changes

Individual changes of this event as published by NVD
Type	Action	Before	After
Description	added	—	A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affected software does not properly validate user-supplied input during a file upload process. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected API endpoint of the affected system. A successful exploit could allow the attacker to create or overwrite any file on the underlying operating system. This file could later be used to elevate to root. To exploit this vulnerability, the attacker must have valid credentials with at least a lower-privileged, single-task user account.
CVSS	added	—	AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness type (CWE)	added	—	CWE-22
Reference	added	—	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ

Source identifier: psirt@cisco.com

One NVD translation into another language is hidden.

Linked advisories

@RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 24SANS @RISK18.06.2026
Recent KEV Additions: LiteSpeed cPanel Plugin, Cisco Catalyst SD-WAN Manager, and Splunk EnterpriseSANS NewsBites14.06.2026
Cisco Catalyst SD-WAN Manager Arbitrary File Write VulnerabilityCisco PSIRT

Embed badge

Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

<a href="https://intel.neosec.eu/en/cve/CVE-2026-20262"><img src="https://intel.neosec.eu/badge/cve/CVE-2026-20262.svg?lang=en" alt="CVE-2026-20262 – NEOSEC Intel" height="20"></a>

What is affected, what to do

Metrics

Response and mitigation

Prioritisation rationale

Immediate response (0-24 h)

Mitigation layers

Detection rules

Detection rules

Classification under NIS2 and CRA

Description

Affected products

Vendors and products

Weakness classes (CWE)

Public exploit references

References & sources

Changes to this CVE

Linked advisories