CVE-2026-20122
Published Feb 25, 2026
Last updated 2 months ago
- Description
- A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system. This vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.
- Source
- psirt@cisco.com
- NVD status
- Analyzed
- Products
- catalyst_sd-wan_manager
CVSS 3.1
- Type
- Primary
- Base score
- 5.4
- Impact score
- 2.5
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Severity
- MEDIUM
- psirt@cisco.com
- CWE-648
- Hype score
- Not currently trending
CVE-2026-20133: CVEs: CVE-2026-20133 · CVE-2026-20128 · CVE-2026-20122 · CVE-2026-20127 Product: Cisco Catalyst SD-WAN Manager formerly vManage < 20.18 CISA KEV: Yes — federal deadline passed April 24 CVE-2026-20133, May 8 CVE-2026-20128 Exploitation Status: Actively…
@lyrie_ai
14 Jun 2026
65 Impressions
0 Retweets
0 Likes
0 Bookmarks
1 Reply
0 Quotes
Cisco's Catalyst SD-WAN Manager faces active exploits of CVE-2026-20122 & CVE-2026-20128. Update systems now to protect your network. Link: https://t.co/FptL5AdTds #Cisco #SDWAN #Cybersecurity #Vulnerabilities #Exploitation #Patching #Networks #Security #Threats #CVE #Routers
@dailytechonx
7 Jun 2026
55 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
PoC is now public for CVE-2026-20127 in Cisco Catalyst SD-WAN. UAT-8616 has been exploiting it since 2023, now anyone can try. Two more SD-WAN flaws also active: CVE-2026-20122 and CVE-2026-20128. Patch window is effectively closed. https://t.co/gZOpZQntR2
@CybrPulse
7 Mar 2026
80 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
🚨Cisco Catalyst SD-WANの脆弱性、さらに2件の悪用が明らかに：CVE-2026-20128、CVE-2026-20122 ⚠️米CISA、Apple製品の古い脆弱性3件をKEVカタログに追加（CVE-2023-43000、CVE-2021-30952、CVE-2023-41974） 〜サイバーアラート3月6日
@MachinaRecord
6 Mar 2026
189 Impressions
1 Retweet
1 Like
0 Bookmarks
0 Replies
0 Quotes
3 Cisco SD-WAN CVEs actively exploited in 8 days. Here's the scorecard: CVE-2026-20127 — CVSS 10.0 — Auth bypass zero-day — Exploited since 2023 CVE-2026-20128 — CVSS 5.5 — DCA credential leak — Exploited (confirmed March 5) CVE-2026-20122 — CVSS 7.1 — File overw
@FirstPassLab
5 Mar 2026
101 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0388BD67-C1AD-4E47-8B1A-22EE1634190E",
"versionEndExcluding": "20.9.8.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ADAB32B5-239D-4DC0-BF30-A6D72ACB3710",
"versionEndExcluding": "20.12.5.3",
"versionStartIncluding": "20.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D284EA84-6C27-4A9C-BDA2-D1C5BF1F2356",
"versionEndExcluding": "20.15.4.2",
"versionStartIncluding": "20.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B94E1DC2-5DA5-4238-8040-6D524DDEAA4F",
"versionEndExcluding": "20.18.2.1",
"versionStartIncluding": "20.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.6:*:*:*:*:*:*:*",
"matchCriteriaId": "F5B6E170-73B8-4838-93B4-AD258F3BCA7C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]