CVE-2026-20122mediumunder attackCWE-648

CVE-2026-20122: medium-severity vulnerability in Cisco Catalyst SD-WAN Manager

Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability

Published · Updated

Follow this CVE+ Monitor Cisco Catalyst SD-WAN Manager+ Monitor Catalyst SD-WAN Manger

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

68Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 5.4epss 26%
from disclosure to weapon7 days
Published on NVDFeb 25
1st PoC+7d
CISA KEV+54d
Action required by CISAfederal deadline: 2026-04-23

Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

In short

A flaw in Cisco Catalyst SD-WAN Manager's API allows an authenticated user with read-only access to overwrite any file on the server by uploading a malicious file. This could let an attacker gain administrative privileges and take control of the system.

Technical detail

The vulnerability stems from improper file handling in the API endpoint that processes file uploads. An authenticated attacker with valid read-only API credentials can exploit this to overwrite arbitrary files on the local filesystem, potentially escalating privileges to vmanage user level. The attack requires valid API credentials but no special network position.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system. This vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected products
Cisco · Cisco Catalyst SD-WAN Manager
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Cisco Catalyst SD-WAN Manager

In the same product, most dangerous first.

CVE-2026-20182CRITICALCisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityEPSS 91.8%KEVCVE-2026-20127CRITICALCisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityEPSS 89.3%KEVCVE-2026-76504CRITICALCisco Catalyst SD-WAN Manager System Account Authorization Bypass VulnerabilityEPSS 38.9%KEVCVE-2026-20133MEDIUMCVE-2026-20133EPSS 31.5%KEVCVE-2026-20262MEDIUMCisco Catalyst SD-WAN Manager Arbitrary File Write VulnerabilityEPSS 29.1%KEVCVE-2026-20245HIGHCisco Catalyst SD-WAN Controller Authenticated Privilege Escalation VulnerabilityEPSS 25.3%KEV