CVE-2026-20262

Published Jun 15, 2026

Last updated a month ago

Zero-day

Server

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-20262 is identified as a directory or path traversal vulnerability affecting Cisco Catalyst SD-WAN Manager, previously known as SD-WAN vManage. This flaw stems from insufficient validation of user-supplied input during file uploads. An authenticated, remote attacker can exploit this by sending a specially crafted HTTP request to an affected API endpoint of the system. Successful exploitation of CVE-2026-20262 allows an attacker to create or overwrite any file on the underlying operating system. This capability can then be leveraged to elevate privileges to root. The vulnerability impacts all deployment types of Cisco Catalyst SD-WAN Manager, including on-premise, cloud-based, and government deployments.

Description: A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affected software does not properly validate user-supplied input during a file upload process. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected API endpoint of the affected system. A successful exploit could allow the attacker to create or overwrite any file on the underlying operating system. This file could later be used to elevate to root. To exploit this vulnerability, the attacker must have valid credentials with at least a lower-privileged, single-task user account.
Source: psirt@cisco.com
NVD status: Analyzed
Products: catalyst_sd-wan_manager

Risk scores

CVSS 3.1

Type: Secondary
Base score: 6.5
Impact score: 3.6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Severity: MEDIUM

Known exploits

Data from CISA

Vulnerability name: Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability
Exploit added on: Jun 15, 2026
Exploit action due: Jun 29, 2026
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

psirt@cisco.com: CWE-22

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "FF1A1919-D28E-4742-BB03-D3F215A0274D",
            "versionEndExcluding": "20.9.9.2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "07958878-5A93-4EE9-91C8-C8271A40CF09",
            "versionEndExcluding": "20.12.7.2",
            "versionStartIncluding": "20.10",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "8834BCEE-821C-4ADD-903E-F285D862F8A0",
            "versionEndExcluding": "20.15.4.5",
            "versionStartIncluding": "20.13",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "931728D6-C3F9-4305-84A5-F3910B4D0A24",
            "versionEndExcluding": "20.15.5.3",
            "versionStartIncluding": "20.15.5",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "65C69D4B-69CF-4001-82EB-10B12BF4A5EB",
            "versionEndExcluding": "20.18.3.1",
            "versionStartIncluding": "20.16",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "5BB1F997-DD81-45C8-B9FE-208A06259D72",
            "versionEndExcluding": "26.1.1.2",
            "versionStartIncluding": "26.1",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.