CISCO Catalyst SD-WAN Flaw Under Active Targeted Exploitation


CVE-2026-20262: CISCO Catalyst SD-WAN Flaw Under Active Targeted Exploitation

Pierluigi Paganini
June 16, 2026

Cisco warned that CVE-2026-20262, a Catalyst SD-WAN Manager vulnerability allowing arbitrary file writes, is being actively exploited.

Cisco confirmed active exploitation of CVE-2026-20262, an arbitrary file write vulnerability affecting Catalyst SD-WAN Manager.

CVE-2026-20262 (CVSS score of 6.5) is an arbitrary file write vulnerability in the web interface of Cisco Catalyst SD-WAN Manager. The flaw is caused by improper validation of user-supplied input during file uploads, allowing an authenticated remote attacker to create or overwrite files on the underlying operating system through a crafted HTTP request.

A successful attack could enable further privilege escalation to root. Exploitation requires valid credentials for a low-privileged user account.

“A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.” reads the advisory. “This vulnerability exists because the affected software does not properly validate user-supplied input during a file upload process. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected API endpoint of the affected system. A successful exploit could allow the attacker to create or overwrite any file on the underlying operating system. This file could later be used to elevate to root. To exploit this vulnerability, the attacker must have valid credentials with at least write access.”

Successful exploitation could enable further compromise of affected systems, prompting Cisco to urge customers to apply available fixes.

Cisco PSIRT has observed limited exploitation of the vulnerability since June 2026 and strongly urges customers to upgrade to a patched software version to mitigate the risk.

The company did not disclose technical details about the attacks exploiting the flaw; however, the networking giant mentioned that CVE-2026-20262 has been exploited in limited attacks, suggesting a highly targeted operation by a sophisticated threat actor. 

This week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the Cisco Catalyst issue to its Known Exploited Vulnerabilities (KEV) catalog ordering federal agencies to fix it by June 29, 2026.

Last week, the U.S. Cybersecurity and Infrastructure Security Agency added another Cisco Catalyst SD-WAN issue, tracked as CVE-2026-20245 (CVSS score v4.0 of 7.1), to its Known Exploited Vulnerabilities (KEV) catalog.

Other vulnerabilities in Cisco SD-WAN discovered this year are CVE-2026-20122CVE-2026-20127CVE-2026-20128, CVE-2026-20133, CVE-2022-20775, and CVE-2026-20182.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISCO Catalyst SD-WAN)







Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


Reaching people who have been let down so many times they’ve stopped expecting anything different takes time, consistency, and trust. The Winter Surge project does all these things and more.

Running every November to March for the past four years, the Winter Surge project – part of our Higher Needs Floating Support service – provides high support temporary accommodation for 17 beds, daily welfare checks, and intensive, trauma-informed care for Bristol’s most entrenched rough sleepers.

Commissioned by Bristol City Council as part of its cold weather provision, it brings together a powerful network of partners including St Mungo’s Outreach, Social Care, Homeless Health, drug and alcohol services and housing providers.

Team Manager Sam Scott has been involved in shaping the project from the start – from planning how it works and selecting temporary accommodation providers, to troubleshooting, managing risk, and feeding back learning to improve the service year-on-year. She says it has been a privilege:

Bristol City Council gave me the opportunity to run Winter Surge and the autonomy to shape it into what it’s become. From the planning stages right through to being on the ground – it’s an extraordinary project to be part of.”

A landmark year

This winter, 42 people came into the service and not one of them went back to the streets. This is the result of a small, skilled team of support workers focused on stabilisation, move-on planning, and wrap-around support covering mental health, safeguarding, benefits, addiction, and wellbeing. After the project ended on 31 March, the wider team makes sure clients move on from the service smoothly with no gap in care.

There are some truly amazing personal stories hidden behind the headline numbers. Four clients who had resisted support for years agreed to come in and stayed for the full duration. One man, who had been living with undiagnosed cancer for over three years, was supported by the team to access hospital treatment. He has now had two major operations and is receiving ongoing care. Sam said:

It’s our patient, trauma-informed relationship building that makes all the difference. I’m so proud of the team and the work we’ve done, particularly this year when not one person went back onto the streets.”

Building trust where it’s been broken

At the heart of the Winter Surge is a commitment to breaking the cycle that sees the most vulnerable people going through many services and feeling constantly let down. The project successfully reduced evictions, improved access to housing, rebuilt confidence in receiving support, and promoted a My Team Around Me approach, ensuring every agency took genuine ownership of their role in a client’s journey.

This is what person-centred, trauma-informed care looks like in practice, and this year it worked for every single person who walked through the door.

Image L-R: Amy O’Loughlin, Sam Scott, Emma Ireland



Source link