Skip to content
VulniPulse
Sign in
Medium6.5Cisco Exploited CISA KEV

Medium [CVE-2026-20262] Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability

This medium-severity Cisco advisory covers CVE-2026-20262 affecting Catalyst SD-WAN Manager.

cisco-sa-sdwan-arbfw-c2rZvQ Published Jun 15, 2026Updated by vendor Jun 15, 2026
CVE-2026-20262
Affected products & platforms
CiscoSD-WANCatalyst SD-WANvManage
Open vendor advisory

Android app · Google Play

Monitor future Cisco CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.

This vulnerability exists because the affected software does not properly validate user-supplied input during a file upload process. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected API endpoint of the affected system.

A successful exploit could allow the attacker to create or overwrite any file on the underlying operating system. This file could later be used to elevate to root.

To exploit this vulnerability, the attacker must have valid credentials with at least write access.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

CISA Known Exploited Vulnerability

Listed:
Jun 15, 2026 · federal remediation due Jun 29, 2026
Required action:
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ransomware use:
Unknown

KEV is a prioritization signal from CISA — remediation detail still comes from the vendor advisory.

Affected versions
  • Scope: At the time of publication, this vulnerability affected Cisco Catalyst SD-WAN Manager, regardless of device configuration.
  • Release 20.9.9.1 and earlier (first fixed: 20.9.9.2)
  • Release 20.12.7.1 and earlier (first fixed: 20.12.7.2)
  • Release 20.15.4.4 and earlier (first fixed: 20.15.4.5)
  • Release 20.15.5.2 and earlier (first fixed: 20.15.5.3)
  • Release 20.18.3 (first fixed: 20.18.3.1)
  • Release 26.1.1.1 and earlier (first fixed: 26.1.1.2)

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Fixed versions
  • 20.9.9.2
  • 20.12.7.2
  • 20.15.4.5
  • 20.15.5.3
  • 20.18.3.1
  • 26.1.1.2

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Upgrade to the first fixed release for your train per the Fixed Releases table in this advisory.
  • Release 20.9.9.1 and earlier: upgrade to 20.9.9.2.
  • Release 20.12.7.1 and earlier: upgrade to 20.12.7.2.
  • Release 20.15.4.4 and earlier: upgrade to 20.15.4.5.
  • Release 20.15.5.2 and earlier: upgrade to 20.15.5.3.
  • Release 20.18.3: upgrade to 20.18.3.1.
  • Release 26.1.1.1 and earlier: upgrade to 26.1.1.2.
Workaround status
  • There are no workarounds that address this vulnerability.

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.