This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Cisco Catalyst SD-WAN Manager fixes an exploited vulnerability

With versions 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1 and 26.1.1.2, Cisco fixes a medium-severity vulnerability in Cisco Catalyst SD-WAN Manager [1], which, based on evidence of active exploitation, has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog [2]. In addition to updating, administrators are advised to check their systems for the indicators of compromise (IoC) that Cisco lists in its report [1].

Cisco Catalyst SD-WAN Manager - arbitrary file write (CVE-2026-20262)
CVSS 6.5 (Medium)

An authenticated remote attacker with write permission can create or overwrite arbitrary files on the system and potentially elevate their privileges to root due to insufficient input validation during file uploads in the Cisco Catalyst SD-WAN Manager web interface [1].

The vulnerability is present in product:

  • Cisco Catalyst SD-WAN; <=20.9.9.1, <20.9.9.2; <=20.12.7.1, <20.12.7.2; <=20.15.4.4, <20.15.4.5; <=20.15.5.2, <20.15.5.3; =20.18.3, <20.18.3.1; <=26.1.1.1, <26.1.1.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:X/RL:X/RC:X

More information:

  • CVE-2026-20262 at cve.org, NVD
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org

The vulnerability was publicly disclosed 15. 6. 2026.

By CESNET, z.s.p.o. Michaela Jarošová on 16. 6. 2026.

CESNET, z.s.p.o. Logo