No attacks on Cisco SD-WAN's five new flaws, and CVE-2026-20310 is 9.1 not 9.9

[Update, August 14, 2026] Nine days on, no attacks. But there was a sixth flaw

Nine days after the August 5 disclosure, there are no reports of exploitation for any of the five. None appear in the Known Exploited Vulnerabilities catalog, and no proof-of-concept code has been published. You can check in our KEV dashboard.

Cisco's advisory (cisco-sa-hardening-sdwan-faLcR3K) is still at version 1.0 with no revisions, and the target versions have not changed. The releases this article points to — 20.9.10, 20.12.8.1, 20.15.6, 20.18.4, 26.1.2, and cloud release 20.15.602 — still hold. The KEV entry for CVE-2026-20262, the one already under attack, is byte-for-byte unchanged (due June 29, ransomware use still "unknown").

There is, however, a sixth flaw this article failed to include.

Some context from around it. On August 11, a flaw in a different Cisco product line — Secure Firewall ASA/FTD, CVE-2026-20349 — was added to KEV. Same vendor, but the product actually under attack is a different one. And the advance notice published on August 12 for the next bundle (August 19) does not include Catalyst SD-WAN, so no further disclosures are expected in the near term.

In Japan, none of the six are registered in JVN iPedia — not even CVE-2026-20262, which is already on KEV. Neither JPCERT/CC nor IPA has published anything on Cisco this month. There is currently no Japanese-language public-sector coverage to follow.

[Update, August 6, 2026] Five more, three of them 9.9 — and the safe version moved

On August 5, 2026, Cisco disclosed five further vulnerabilities in Catalyst SD-WAN. Three are rated 9.9, effectively the ceiling of the ten-point scale.

And there is a consequence: the versions this article has been calling safe do not fix these five. The upgrade targets have moved.

None of the five has a workaround. There is no setting to change; Cisco states plainly that none are available.

The five

(*) CVE-2026-20310 is rated 9.1. This article originally said 9.9 (corrected August 14, 2026). Open Cisco's advisory page and the header shows 9.9, which is why most outlets report that figure for 20310. But that is the advisory-level maximum: the same 9.9 appears next to all five CVEs. Pull the machine-readable primary data Cisco publishes (CSAF) and 20310 comes back as CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H — 9.1. It is the only one of the five marked PR:H, meaning it requires high privileges to begin with, where the other four need only PR:L. NVD records 9.1 as well, so Cisco and NVD never disagreed.

CVE-2026-20312 is a different kind of problem: sensitive data was stored without encryption. It matters less as a way in than as what can be carried out once someone is already inside.

These five did not surface through attacks

The advisory opens: "As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted an internal security review." Cisco found these in its own product, and no exploitation or public exploit code has been observed.

The subject of this article, CVE-2026-20262, was confirmed as actively exploited. These five are a different case — yet they score higher: 8.8 for 20262 against three 9.9s here. Severity measures what happens if a flaw is exploited, not whether it is being exploited.

The same day, Cisco published ten more for IOS XE from the same internal review — also without workarounds, topping out at 9.8.

Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage), the system that centrally manages a company's wide-area network, has a vulnerability — tracked as CVE-2026-20262 — that lets anyone who can log in, even with a low-privileged account, overwrite files on the server and ultimately seize root (the administrator privilege that can do anything). Exploitation in real attacks has been confirmed. If you run a fixed release (20.9.9.2 / 20.12.7.2 / 20.15.4.5 / 20.15.5.3 / 20.18.3.1 / 26.1.1.2) or later, no further action is needed for this flaw. If you run anything older, you need to update.

The flaw was disclosed on June 15, 2026 in Cisco's security advisory, in which Cisco stated it "has confirmed limited exploitation of this vulnerability in the wild." The same day, the U.S. agency CISA added it to its list of actively exploited vulnerabilities (the KEV catalog), requiring federal agencies to remediate by June 29, 2026 — a deadline that has already passed. The advisory has not been revised since publication, and the list of fixed releases is unchanged. As of July 23, 2026, no new advisory for this product and no further KEV additions have been observed.

What is Cisco Catalyst SD-WAN Manager

Companies with many branches and sites use a setup called "SD-WAN" to efficiently bundle the wide-area network (WAN) connecting those offices. Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) is the command center that configures and monitors that entire network from a single screen. It is widely used by large organizations with multiple sites — in finance, telecom, manufacturing, and government.

This command center is in the position of pushing out, in bulk, settings such as what traffic each site's router permits and which paths to take. That is exactly why, once it is seized, an attacker can view, rewrite, or cut off the communications of the entire company — making it an extremely valuable target. We have also covered a different vulnerability in the same product, CVE-2026-20245 (also exploited, with a risk of root takeover). According to Mandiant's report, that one was exploited as a zero-day (attacks that begin before a fix exists) starting in March 2026, before the fix was published. CVE-2026-20262, the subject of this article, is a separate flaw.

Holding just one small key is enough to become master of the command center

Because this vulnerability comes with the condition "a login is required," it is not the type that anyone can land from outside in a single shot. Even so, the danger cannot be downplayed, because Cisco has confirmed real-world exploitation. The attacker's starting point is simply "obtain one minimal account — any will do — that can log into this admin screen," and from there the path to becoming master of the command center was wide open thanks to this hole.

The ones who come to grab that small key are attackers already inside the corporate network looking for their next move, crews trying reused IDs and passwords stolen from other sites, insiders nearing resignation or disgruntled over their treatment, and impostors posing as an outsourced operations contractor. What they truly want is not the low-privileged account itself, but the control over the entire company's communications that lies beyond it. Seize root and you can freely rewrite each site's router settings to eavesdrop on traffic, cut off a particular site, or redirect it onto a fake path. The moment a single low-privileged account leaks, this hole becomes the springboard, and the command center itself is taken over wholesale.

Mechanically, the cause is that the file-upload process does not adequately validate where files are saved. What should only ever be saved to a designated location can instead jump past it (path traversal) to create or overwrite the system's critical files. Use that to swap out, say, a configuration that runs at startup, and it leads to seizing the service's privileges — and ultimately root. Although this is a post-login action, the bar for that first login is, in reality, far from high when combined with separate attacks on authentication weaknesses or with reused passwords.

The number "severity 6.5" looks modest, since a login is required. But in the face of confirmed exploitation, what matters is not the size of the number but "what you lose if it is stepped on." A company whose SD-WAN command center is seized loses the confidentiality of all-site communications, operations that can no longer be kept running, path settings that could be tampered with, and the worst-case premise that "the core of the internal network has been commandeered". When the command center falls, every site hanging beneath it is endangered at once.

CVE-2026-20262: overwriting files by jumping past the save location

According to Cisco's advisory, CVE-2026-20262 stems from insufficient input validation in the web UI's file-upload process. A logged-in attacker who sends a crafted request can create or overwrite files at an arbitrary location on the system, and use that as a stepping stone toward escalating to root. It is classified as path traversal (CWE-22).

The technical scoring (CVSS vector) is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, for a score of 6.5. The gist is: over the network (AV:N), under easy conditions (AC:L), with just a low-privileged login (PR:L) and no user interaction (UI:N), file tampering (I:H) can be caused. The ratings for information disclosure and service outage themselves are low, but the real danger is the path from overwriting a file to seizing root — and Cisco's confirmation of exploitation bears that out.

How to tell whether your version is affected, and what to do

Cisco provides a fixed release for each version train. Check the software version you run, and update if it is older than the fixed release below. If you are already on the fixed release or later, this flaw is dealt with.

If you still run an affected release, the top priority is updating to a fixed one. Since exploitation of this flaw has been confirmed, apply it without waiting for your regular update cycle. Cisco has also published a remediation guide for its June 2026 batch of SD-WAN advisories. Also revisit limiting who can reach the admin screen to a trusted management segment, auditing and removing unused accounts, resetting passwords including for low-privileged accounts, and enabling multi-factor authentication.

Checking whether you were already compromised before updating matters too. The notes on CISA's KEV listing for this flaw call for forensic triage — confirming whether traces of compromise exist — alongside remediation. Look for files created or modified that you do not recognize, login records from unexpected accounts, and suspicious configuration changes. If you cannot tell, cross-check Cisco's guidance against your logs and consult your response team early.

The network command center keeps being targeted

Cases where the "command center" of a network or security stack becomes the target keep coming. On this site, in addition to a different exploited flaw in the same Cisco Catalyst SD-WAN Manager, CVE-2026-20245, we have covered the management backbone for employee phones, Ivanti Sentry, falling without authentication (CVE-2026-10520 and others), and a Check Point VPN authentication bypass abused by a ransomware crew (CVE-2026-50751).

The flip side of these management platforms' convenience — protect one and you protect many — is that breach one and everything beneath it is endangered in a chain. In fact, the Cisco Catalyst SD-WAN line has produced a string of KEV-listed, exploited vulnerabilities through 2026: CVE-2026-20127 in February; CVE-2026-20122 / 20133 / 20128 in April; the authentication bypass CVE-2026-20182 in May, for which CISA issued the emergency directive ED 26-03 ordering federal agencies to act; and CVE-2026-20245 and this article's CVE-2026-20262 in June. That many exploited flaws in the same product shows that command centers of this kind are being targeted intensively by attackers. That is exactly why the management platform itself must be updated as a top priority and its access paths narrowed.

Exploitation status and KEV listing

For CVE-2026-20262, Cisco itself has stated it has "confirmed limited real-world exploitation," and its security response team (Cisco PSIRT) observed targeted exploitation starting in June 2026. The flaw was added to the U.S. government's CISA KEV catalog of actively exploited vulnerabilities on June 15, 2026, and the remediation deadline imposed on federal agencies (June 29) has already passed. On the other hand, the catalog still lists ransomware campaign use as "Unknown," and as of July 23, 2026 no follow-up reports of expanded exploitation have been observed. You can track the latest status of exploited flaws in one place on our CISA KEV dashboard (Japanese).

It is dangerous to defer this based solely on "a login is required" and "severity 6.5." Exploitation has been confirmed, and combined with the leak or reuse of low-privileged accounts, it leads directly to real damage. If you still run an affected release, getting the update applied and checking for compromise is the most reliable defense. If you run a fixed release or later, this flaw is nothing to worry about.

References

• ▸ NVD - CVE-2026-20262 (published June 15, 2026)
• ▸ Cisco Security Advisory - Catalyst SD-WAN Manager Arbitrary File Write (CVE-2026-20262)
• ▸ Cisco - Remediate Catalyst SD-WAN Security Advisory - June 2026
• ▸ MITRE - CWE-22: Path Traversal
• ▸ CISA - Known Exploited Vulnerabilities Catalog
• ▸ CISA - Emergency Directive 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems
• ▸ Mandiant / Google Cloud - Zero-Day Exploitation of Cisco Catalyst SD-WAN Manager (CVE-2026-20245)