Cisco Catalyst SD-WAN Manager File-Write Vulnerability: Current Status and Safe Versions

Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage), the system that centrally manages a company's wide-area network, has a vulnerability — tracked as CVE-2026-20262 — that lets anyone who can log in, even with a low-privileged account, overwrite files on the server and ultimately seize root (the administrator privilege that can do anything). Exploitation in real attacks has been confirmed. If you run a fixed release (20.9.9.2 / 20.12.7.2 / 20.15.4.5 / 20.15.5.3 / 20.18.3.1 / 26.1.1.2) or later, no further action is needed for this flaw. If you run anything older, you need to update.

The flaw was disclosed on June 15, 2026 in Cisco's security advisory, in which Cisco stated it "has confirmed limited exploitation of this vulnerability in the wild." The same day, the U.S. agency CISA added it to its list of actively exploited vulnerabilities (the KEV catalog), requiring federal agencies to remediate by June 29, 2026 — a deadline that has already passed. The advisory has not been revised since publication, and the list of fixed releases is unchanged. As of July 23, 2026, no new advisory for this product and no further KEV additions have been observed.

What is Cisco Catalyst SD-WAN Manager

Companies with many branches and sites use a setup called "SD-WAN" to efficiently bundle the wide-area network (WAN) connecting those offices. Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) is the command center that configures and monitors that entire network from a single screen. It is widely used by large organizations with multiple sites — in finance, telecom, manufacturing, and government.

This command center is in the position of pushing out, in bulk, settings such as what traffic each site's router permits and which paths to take. That is exactly why, once it is seized, an attacker can view, rewrite, or cut off the communications of the entire company — making it an extremely valuable target. We have also covered a different vulnerability in the same product, CVE-2026-20245 (also exploited, with a risk of root takeover). According to Mandiant's report, that one was exploited as a zero-day (attacks that begin before a fix exists) starting in March 2026, before the fix was published. CVE-2026-20262, the subject of this article, is a separate flaw.

Holding just one small key is enough to become master of the command center

Because this vulnerability comes with the condition "a login is required," it is not the type that anyone can land from outside in a single shot. Even so, the danger cannot be downplayed, because Cisco has confirmed real-world exploitation. The attacker's starting point is simply "obtain one minimal account — any will do — that can log into this admin screen," and from there the path to becoming master of the command center was wide open thanks to this hole.

The ones who come to grab that small key are attackers already inside the corporate network looking for their next move, crews trying reused IDs and passwords stolen from other sites, insiders nearing resignation or disgruntled over their treatment, and impostors posing as an outsourced operations contractor. What they truly want is not the low-privileged account itself, but the control over the entire company's communications that lies beyond it. Seize root and you can freely rewrite each site's router settings to eavesdrop on traffic, cut off a particular site, or redirect it onto a fake path. The moment a single low-privileged account leaks, this hole becomes the springboard, and the command center itself is taken over wholesale.

Mechanically, the cause is that the file-upload process does not adequately validate where files are saved. What should only ever be saved to a designated location can instead jump past it (path traversal) to create or overwrite the system's critical files. Use that to swap out, say, a configuration that runs at startup, and it leads to seizing the service's privileges — and ultimately root. Although this is a post-login action, the bar for that first login is, in reality, far from high when combined with separate attacks on authentication weaknesses or with reused passwords.

The number "severity 6.5" looks modest, since a login is required. But in the face of confirmed exploitation, what matters is not the size of the number but "what you lose if it is stepped on." A company whose SD-WAN command center is seized loses the confidentiality of all-site communications, operations that can no longer be kept running, path settings that could be tampered with, and the worst-case premise that "the core of the internal network has been commandeered". When the command center falls, every site hanging beneath it is endangered at once.

CVE-2026-20262: overwriting files by jumping past the save location

According to Cisco's advisory, CVE-2026-20262 stems from insufficient input validation in the web UI's file-upload process. A logged-in attacker who sends a crafted request can create or overwrite files at an arbitrary location on the system, and use that as a stepping stone toward escalating to root. It is classified as path traversal (CWE-22).

The technical scoring (CVSS vector) is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, for a score of 6.5. The gist is: over the network (AV:N), under easy conditions (AC:L), with just a low-privileged login (PR:L) and no user interaction (UI:N), file tampering (I:H) can be caused. The ratings for information disclosure and service outage themselves are low, but the real danger is the path from overwriting a file to seizing root — and Cisco's confirmation of exploitation bears that out.

How to tell whether your version is affected, and what to do

Cisco provides a fixed release for each version train. Check the software version you run, and update if it is older than the fixed release below. If you are already on the fixed release or later, this flaw is dealt with.

If you still run an affected release, the top priority is updating to a fixed one. Since exploitation of this flaw has been confirmed, apply it without waiting for your regular update cycle. Cisco has also published a remediation guide for its June 2026 batch of SD-WAN advisories. Also revisit limiting who can reach the admin screen to a trusted management segment, auditing and removing unused accounts, resetting passwords including for low-privileged accounts, and enabling multi-factor authentication.

Checking whether you were already compromised before updating matters too. The notes on CISA's KEV listing for this flaw call for forensic triage — confirming whether traces of compromise exist — alongside remediation. Look for files created or modified that you do not recognize, login records from unexpected accounts, and suspicious configuration changes. If you cannot tell, cross-check Cisco's guidance against your logs and consult your response team early.

The network command center keeps being targeted

Cases where the "command center" of a network or security stack becomes the target keep coming. On this site, in addition to a different exploited flaw in the same Cisco Catalyst SD-WAN Manager, CVE-2026-20245, we have covered the management backbone for employee phones, Ivanti Sentry, falling without authentication (CVE-2026-10520 and others), and a Check Point VPN authentication bypass abused by a ransomware crew (CVE-2026-50751).

The flip side of these management platforms' convenience — protect one and you protect many — is that breach one and everything beneath it is endangered in a chain. In fact, the Cisco Catalyst SD-WAN line has produced a string of KEV-listed, exploited vulnerabilities through 2026: CVE-2026-20127 in February; CVE-2026-20122 / 20133 / 20128 in April; the authentication bypass CVE-2026-20182 in May, for which CISA issued the emergency directive ED 26-03 ordering federal agencies to act; and CVE-2026-20245 and this article's CVE-2026-20262 in June. That many exploited flaws in the same product shows that command centers of this kind are being targeted intensively by attackers. That is exactly why the management platform itself must be updated as a top priority and its access paths narrowed.

Exploitation status and KEV listing

For CVE-2026-20262, Cisco itself has stated it has "confirmed limited real-world exploitation," and its security response team (Cisco PSIRT) observed targeted exploitation starting in June 2026. The flaw was added to the U.S. government's CISA KEV catalog of actively exploited vulnerabilities on June 15, 2026, and the remediation deadline imposed on federal agencies (June 29) has already passed. On the other hand, the catalog still lists ransomware campaign use as "Unknown," and as of July 23, 2026 no follow-up reports of expanded exploitation have been observed. You can track the latest status of exploited flaws in one place on our CISA KEV dashboard (Japanese).

It is dangerous to defer this based solely on "a login is required" and "severity 6.5." Exploitation has been confirmed, and combined with the leak or reuse of low-privileged accounts, it leads directly to real damage. If you still run an affected release, getting the update applied and checking for compromise is the most reliable defense. If you run a fixed release or later, this flaw is nothing to worry about.

References

• ▸ NVD - CVE-2026-20262 (published June 15, 2026)
• ▸ Cisco Security Advisory - Catalyst SD-WAN Manager Arbitrary File Write (CVE-2026-20262)
• ▸ Cisco - Remediate Catalyst SD-WAN Security Advisory - June 2026
• ▸ MITRE - CWE-22: Path Traversal
• ▸ CISA - Known Exploited Vulnerabilities Catalog
• ▸ CISA - Emergency Directive 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems
• ▸ Mandiant / Google Cloud - Zero-Day Exploitation of Cisco Catalyst SD-WAN Manager (CVE-2026-20245)