6.5 Medium Exploited

CVE-2026-20262 Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Ransomware campaigns Not observed so far

Weakness CWE-22

Description

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affected software does not properly validate user-supplied input during a file upload process. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected API endpoint of the affected system. A successful exploit could allow the attacker to create or overwrite any file on the underlying operating system. This file could later be used to elevate to root. To exploit this vulnerability, the attacker must have valid credentials with at least a lower-privileged, single-task user account.

Affected products and versions

Product	Affected versions	Fixed in
Cisco Catalyst SD-WAN Manager 26.1	26.1.1 → 26.1.1.1	No fix stated
Cisco Catalyst SD-WAN Manager	26.0.1	No fix stated
Cisco Catalyst SD-WAN Manager 20.18	20.18.1 → 20.18.3	No fix stated
Cisco Catalyst SD-WAN Manager	20.16.1	No fix stated
Cisco Catalyst SD-WAN Manager 20.15	20.15.1 → 20.15.5.2	No fix stated
Cisco Catalyst SD-WAN Manager	20.14.1	No fix stated
Cisco Catalyst SD-WAN Manager	20.13.1	No fix stated
Cisco Catalyst SD-WAN Manager 20.12	20.12.1 → 20.12.501	No fix stated
Cisco Catalyst SD-WAN Manager 20.11	20.11.1 → 20.11.1.2	No fix stated

Show the 17 other branches

Product	Affected versions	Fixed in
Cisco Catalyst SD-WAN Manager 20.10	20.10.1 → 20.10.1.2	No fix stated
Cisco Catalyst SD-WAN Manager 20.9	20.9.1EFT2 → 20.9.9.1	No fix stated
Cisco Catalyst SD-WAN Manager	20.8.1	No fix stated
Cisco Catalyst SD-WAN Manager 20.7	20.7.1EFT2 → 20.7.2	No fix stated
Cisco Catalyst SD-WAN Manager 20.6	20.6.0.18.3 → 20.6.8	No fix stated
Cisco Catalyst SD-WAN Manager 20.5	20.5.0.1.1 → 20.5.1.2	No fix stated
Cisco Catalyst SD-WAN Manager 20.4	20.4.1 → 20.4.2.3	No fix stated
Cisco Catalyst SD-WAN Manager 20.3	20.3.1 → 20.3.814	No fix stated
Cisco Catalyst SD-WAN Manager 20.1	20.1.1 → 20.1.12	No fix stated
Cisco Catalyst SD-WAN Manager	19.3.0	No fix stated
Cisco Catalyst SD-WAN Manager 19.2	19.2.0 → 19.2.929	No fix stated
Cisco Catalyst SD-WAN Manager	19.1.0	No fix stated
Cisco Catalyst SD-WAN Manager 19.0	19.0.0 → 19.0.1a	No fix stated
Cisco Catalyst SD-WAN Manager 18.4	18.4.0 → 18.4.303	No fix stated
Cisco Catalyst SD-WAN Manager 18.3	18.3.0 → 18.3.8	No fix stated
Cisco Catalyst SD-WAN Manager	18.2.0	No fix stated
Cisco Catalyst SD-WAN Manager 17.2	17.2.4 → 17.2.10	No fix stated