CVE-2026-20262 is a critical path traversal (CWE-22) vulnerability in Cisco Catalyst SD-WAN Manager allowing remote attackers to write arbitrary files anywhere on the underlying operating system via a crafted file upload request. Cisco confirms active exploitation in limited attacks observed June 11, 2026. The arbitrary file write can be chained to escalate privileges to root, enabling complete appliance takeover. A zero-day and CISA KEV listed. No workarounds exist — patching is the only remediation.
CVE-2026-20262TA2026168CWE-22 Path TraversalCVE-2026-20262 is a critical path traversal vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage), classified under CWE-22. The flaw stems from improper validation of user-supplied input during file upload, allowing an attacker with a valid low-privilege account to manipulate file paths and bypass directory restrictions, enabling unauthorized file write operations anywhere on the underlying operating system.
The arbitrary file write capability serves as a stepping stone for privilege escalation to root, enabling complete administrative control over the appliance. Cisco has confirmed active exploitation in limited attacks first observed June 11, 2026, though no specific threat actor or malware campaign has been publicly attributed. The vulnerability affects all deployment models — on-premises, Cisco SD-WAN Cloud-Pro, Cisco SD-WAN Cloud (Cisco Managed), and Cisco SD-WAN for Government (FedRAMP) — across multiple release trains through the 26.1.x series.
Cisco has confirmed there are no workarounds. Patching is the only effective remediation. Fixed releases are available now.
| CVE ID | Vulnerability Name | Affected Products | Affected CPE | CWE | Zero-Day | CISA KEV | Patch |
|---|---|---|---|---|---|---|---|
CVE-2026-20262 |
Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability | Cisco Catalyst SD-WAN Manager: 20.9.9.1 and earlier · 20.12.7.1 and earlier · 20.15.4.4 and earlier · 20.15.5.2 and earlier · 20.18.3 · 26.1.1.1 and earlier |
cpe:2.3:a:cisco:catalyst_sdwan_manager:*:*:*:*:*:*:*:* |
CWE-22 |
✓ Yes | ✓ Yes | ✓ Yes |
26.1.x series are affected. No specific threat actor or malware campaign has been publicly attributed. Cisco has stated there are no workarounds — patching to a fixed release is the only effective remediation. Fixed log indicators of compromise are published in Cisco's security advisory.Upgrade Cisco Catalyst SD-WAN Manager to the first fixed release for your software train immediately. There are no workarounds.
| Vulnerable Release Train | First Fixed Release |
|---|---|
20.9.9.1 and earlier |
20.9.9.2 |
20.12.7.1 and earlier |
20.12.7.2 |
20.15.4.4 and earlier |
20.15.4.5 |
20.15.5.2 and earlier |
20.15.5.3 |
20.18.3 |
20.18.3.1 |
26.1.1.1 and earlier |
26.1.1.2 |
20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, or 26.1.1.2. Cisco has confirmed exploitation in the wild, added this to mandatory remediation tracking, and stated there are no workarounds. Patching is the only effective remediation.vmanage-server.log and vmanage-appserver.log (under /var/log/nms) for unexpected file uploads or WAR deployments into the WildFly standalone deployments directory. Review serviceproxy-access.log (under /var/log/nms/containers/service-proxy/) for HTTP POST requests to unrecognized JSP endpoints. If suspicious entries are found, open a TAC case and provide a request admin-tech output for Cisco review.| Tactic | Technique | Sub-technique & Notes |
|---|---|---|
| Initial Access | T1190 |
Exploit Public-Facing Application — crafted HTTP file upload request exploits path traversal in SD-WAN Manager API endpoint to write arbitrary files |
| Initial Access | T1078 |
Valid Accounts — exploitation requires a valid low-privilege or single-task SD-WAN Manager account; these account types are the direct exploitation vector |
| Persistence | T1505 |
Server Software Component — maliciously written files deployed to WildFly standalone deployments directory (WAR files, JSP endpoints) to establish persistent server-side access |
| Resource Dev | T1588 |
T1588.006 Vulnerabilities — CVE-2026-20262 zero-day exploited in limited attacks observed June 11, 2026; no public PoC attribution noted in advisory |
