CVE-2026-20262

Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability

MEDIUM

6.5

CVSS Score

Published: June 15, 2026 at 04:21 PM UTC

Updated: July 24, 2026 at 07:10 PM UTC

1 product affected across 1 vendorCatalyst Sd WAN Manager

Using Cisco Catalyst SD-WAN Manager by Cisco?

Get instant alerts when new vulnerabilities affect Cisco Catalyst SD-WAN Manager - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.5

Exploitation

CISA KEV

Exploit prediction

EPSS 29%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score29.1%

EPSS (Exploit Prediction Scoring System) estimates a 29.1% chance this CVE is exploited in the wild within the next 30 days — higher than 98% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.

Required Action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Ransomware Use

Unknown

Added to KEV

Jun 15, 2026

Remediation Due

Jun 29, 2026

119 days overdue

Notes

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ

BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk

Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk

https://nvd.nist.gov/vuln/detail/CVE-2026-20262

Description

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affected software does not properly validate user-supplied input during a file upload process. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected API endpoint of the affected system. A successful exploit could allow the attacker to create or overwrite any file on the underlying operating system. This file could later be used to elevate to root. To exploit this vulnerability, the attacker must have valid credentials with at least a lower-privileged, single-task user account.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Catalyst Sd WAN Manager · Cisco

95%

v < 20.9.9.220.10 ≤ v < 20.12.7.220.13 ≤ v < 20.15.4.520.15.5 ≤ v < 20.15.5.320.16 ≤ v < 20.18.3.126.1 ≤ v < 26.1.1.217.2.10 17.2.4 17.2.5 17.2.6 17.2.7 17.2.8 17.2.9 18.2.0 18.3.0 18.3.1 18.3.1.1 18.3.3 18.3.3.1 18.3.4 18.3.5 18.3.6 18.3.6.1 18.3.7 18.3.8 18.4.0 18.4.0.1 18.4.1 18.4.3 18.4.302 18.4.303 18.4.4 18.4.518.4.501_ES18.4.6 19.0.0 19.0.1a 19.1.0 19.2.0 19.2.097 19.2.098 19.2.099 19.2.1 19.2.2 19.2.3 19.2.31 19.2.32 19.2.4 19.2.4.0.1 19.2.4.0.8 19.2.4.0.9 19.2.929 19.3.0 20.1.1 20.1.1.1 20.1.12 20.1.2 20.1.2_937 20.1.3 20.1.3.1 20.10.1 20.10.1.1 20.10.1.220.10.1_LI_Images20.11.1 20.11.1.1 20.11.1.220.11.1_LI_Images20.12.120.12.1_LI_Images20.12.220.12.2_LI_Images20.12.3 20.12.3.120.12.3_LI_Images20.12.4 20.12.4.0.03 20.12.4.0.4 20.12.4.0.6 20.12.4.1 20.12.4.1_LI_Images 20.12.401 20.12.4_LI_Images20.12.4_Monthly_ES520.12.5 20.12.5.1 20.12.5.1.01 20.12.5.1_LI_Images 20.12.5.2 20.12.5.2_LI_Images 20.12.5.3 20.12.5.3_LI_Images 20.12.5.4 20.12.5.4_LI_ Images 20.12.501 20.12.5_LI_Images 20.12.6 20.12.6.1 20.12.6.1_LI_Images 20.12.6.2 20.12.6.2_LI_Images 20.12.6_LI_Images 20.12.7 20.12.7.1 20.12.7.1_LI_Images 20.12.7_LI_Images 20.13.120.13.1_LI_Images20.14.120.14.1_LI_Images20.15.1 20.15.1_LI_Images 20.15.2 20.15.2_LI_Images 20.15.3 20.15.3.1 20.15.3_ LI _Images 20.15.4 20.15.4.1 20.15.4.1_LI_Images 20.15.4.2 20.15.4.2_LI_Images 20.15.4.3 20.15.4.3_LI_Images 20.15.4.4 20.15.4.4_LI_Images 20.15.4_LI_Images 20.15.5 20.15.5.1 20.15.5.1_LI_Images 20.15.5.2 20.15.5.2_LI_Images 20.15.5_LI_Images 20.16.1 20.16.1_LI_Images 20.18.1 20.18.1_LI_Images 20.18.2 20.18.2.1 20.18.2.1_LI_Images 20.18.2.2 20.18.2.2_LI_Images 20.18.2_LI_Images 20.18.3 20.18.3_LI_Images 20.3.1 20.3.2 20.3.2.0.5 20.3.2.0.6 20.3.2.1 20.3.2.1_927 20.3.2.1_930 20.3.2_925 20.3.2_928 20.3.2_929 20.3.2_937 20.3.3 20.3.3.0.14 20.3.3.0.16 20.3.3.0.17 20.3.3.0.18 20.3.3.0.2 20.3.3.0.4 20.3.3.0.8 20.3.3.1 20.3.3.1.1 20.3.3.1.10 20.3.3.1.2 20.3.3.1.5 20.3.3.1.7 20.3.3.2 20.3.4 20.3.4.0.1 20.3.4.0.11 20.3.4.0.19 20.3.4.0.20 20.3.4.0.24 20.3.4.0.25 20.3.4.0.26 20.3.4.0.5 20.3.4.0.6 20.3.4.0.9 20.3.4.1 20.3.4.1.1 20.3.4.1.2 20.3.4.2 20.3.4.2.1 20.3.4.2.2 20.3.4.3 20.3.5 20.3.5.0.7 20.3.5.0.8 20.3.5.0.9 20.3.5.1 20.3.6 20.3.7 20.3.7.1 20.3.7.2 20.3.8 20.3.813 20.3.814 20.4.1 20.4.1.0.01 20.4.1.0.02 20.4.1.0.1 20.4.1.1 20.4.1.1.5 20.4.1.2 20.4.2 20.4.2.0.1 20.4.2.0.2 20.4.2.0.4 20.4.2.1 20.4.2.1.1 20.4.2.2 20.4.2.2.1 20.4.2.2.2 20.4.2.2.3 20.4.2.2.4 20.4.2.2.8 20.4.2.3 20.5.0.1.1 20.5.1 20.5.1.0.1 20.5.1.0.2 20.5.1.1 20.5.1.2 20.6.0.18.3 20.6.0.18.4 20.6.1 20.6.1.0.1 20.6.1.1 20.6.1.2 20.6.2 20.6.2.0.4 20.6.2.1 20.6.2.2 20.6.2.2.2 20.6.2.2.3 20.6.2.2.4 20.6.2.2.7 20.6.3 20.6.3.0.10 20.6.3.0.11 20.6.3.0.14 20.6.3.0.18 20.6.3.0.19 20.6.3.0.2 20.6.3.0.23 20.6.3.0.25 20.6.3.0.27 20.6.3.0.29 20.6.3.0.31 20.6.3.0.32 20.6.3.0.33 20.6.3.0.38 20.6.3.0.39 20.6.3.0.40 20.6.3.0.41 20.6.3.0.45 20.6.3.0.46 20.6.3.0.47 20.6.3.0.5 20.6.3.0.51 20.6.3.0.7 20.6.3.1 20.6.3.1.1 20.6.3.2 20.6.3.3 20.6.3.4 20.6.4 20.6.4.0.19 20.6.4.0.21 20.6.4.0.4 20.6.4.1 20.6.4.2 20.6.5 20.6.5.1 20.6.5.1.10 20.6.5.1.11 20.6.5.1.13 20.6.5.1.14 20.6.5.1.2 20.6.5.1.3 20.6.5.1.4 20.6.5.1.5 20.6.5.1.6 20.6.5.1.7 20.6.5.1.9 20.6.5.2 20.6.5.2.1 20.6.5.2.3 20.6.5.2.4 20.6.5.2.8 20.6.5.3 20.6.5.4 20.6.5.5 20.6.6 20.6.6.0.1 20.6.7 20.6.8 20.7.1 20.7.1.0.2 20.7.1.1 20.7.1EFT2 20.7.2 20.8.1 20.9.1 20.9.1.120.9.1EFT220.9.1_LI_Images20.9.2 20.9.2.0.01 20.9.2.1 20.9.2.2 20.9.2.3 20.9.2_LI_Images 20.9.3 20.9.3.0.12 20.9.3.0.16 20.9.3.0.17 20.9.3.0.18 20.9.3.0.2 20.9.3.0.20 20.9.3.0.21 20.9.3.0.23 20.9.3.0.24 20.9.3.0.25 20.9.3.0.26 20.9.3.0.29 20.9.3.0.3 20.9.3.0.4 20.9.3.0.5 20.9.3.0.7 20.9.3.0.8 20.9.3.1 20.9.3.2 20.9.3.2_LI_Images20.9.3_LI_ Images20.9.4 20.9.4.0.4 20.9.4.1 20.9.4.1.1 20.9.4.1.3 20.9.4.1.620.9.4.1_LI_Images20.9.4_LI_Images20.9.5 20.9.5.1 20.9.5.1.420.9.5.1_LI_Images20.9.5.2 20.9.5.2.1 20.9.5.2.13 20.9.5.2.14 20.9.5.2.16 20.9.5.2.21 20.9.5.2.720.9.5.2_LI_Images20.9.5.3 20.9.5.3_LI_Images20.9.5_LI_Images20.9.6 20.9.6.0.3 20.9.6_LI_Images 20.9.7 20.9.7.1 20.9.7.1_LI _Images 20.9.7_LI _Images 20.9.8 20.9.8.2 20.9.8.2_LI_Images 20.9.8_LI_Images 20.9.9 20.9.9.1 20.9.9.1_LI_Images 20.9.9_LI_Images 26.0.1 26.1.1 26.1.1.1 26.1.1.1_LI_Images 26.1.1_LI_Images

Affected range stops below 20.12.7.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.15.4.5, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.15.5.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.18.3.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.9.9.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 26.1.1.2, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ

References (2)

Vendor Advisory

Source: cverecord

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ

US Government Resource

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20262

SSVC — Action Prioritization

SSVCActiveNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.5MEDIUMcisco

Attack Vector: NETWORK
Complexity: LOW
Privileges: LOW
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: NONE
Integrity: HIGH
Availability: NONE

Vector?

Quick Info

StatusANALYZED

CWE

CWE-22

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card