Vulnerability record · CVE-2026-20122 · published 25 February 2026
CVE-2026-20122: Cisco Catalyst SD-WAN Manager API arbitrary file overwrite
Cisco · Catalyst Sd Wan Manager
The API interface of Cisco Catalyst SD-WAN Manager mishandles uploaded files, letting an authenticated remote attacker overwrite arbitrary files on the local file system. Because the overwritten files can lead to vmanage user privileges, a low-privileged account can escalate its access on a core SD-WAN management component.
Description
A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system. This vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Automated analysis
high priorityThe flaw allows privilege escalation on a central SD-WAN management system and is in CISA KEV with a near-term remediation deadline, though it requires valid credentials and has only medium CVSS impact.
What it is
The API interface of Cisco Catalyst SD-WAN Manager mishandles uploaded files, letting an authenticated remote attacker overwrite arbitrary files on the local file system. Because the overwritten files can lead to vmanage user privileges, a low-privileged account can escalate its access on a core SD-WAN management component.
Impact
An attacker with valid read-only API credentials can overwrite arbitrary files and gain vmanage user privileges, giving control over the SD-WAN management plane.
Attack surface
Reachable over the network through the product's API; the attacker needs valid read-only credentials with API access, and no user interaction is required.
Exploitation
CVE-2026-20122 is listed in CISA KEV with a remediation due date of 2026-04-23, and EPSS gives it a 30-day probability of about 24.6 percent (97.8th percentile), indicating active exploitation is expected or observed.
What to do
- Apply the Cisco security advisory fix for Catalyst SD-WAN Manager as soon as possible, following CISA Emergency Directive 26-03 timelines.
- Restrict API access to trusted management networks and disable or tightly scope read-only API accounts that are not required.
- Rotate credentials and review accounts with API access for signs of misuse or unexpected creation.
- Follow CISA's Hunt & Hardening Guidance for Cisco SD-WAN devices and BOD 22-01 cloud service guidance, discontinuing use if mitigations are unavailable.
Detection
- Monitor SD-WAN Manager API logs for file upload requests from read-only accounts or unusual endpoints.
- Alert on unexpected changes to files on the SD-WAN Manager local file system, especially files tied to vmanage privileges.
- Review authentication logs for read-only API accounts authenticating from new or anomalous source addresses.
- Correlate API activity with subsequent privilege changes or new vmanage-level sessions.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2026-20122 to the Known Exploited Vulnerabilities catalog on 20 April 2026 as "Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability". Required action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. Federal deadline 23 April 2026.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20122 | US Government Resource |
Track CVE-2026-20122 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2026-20122), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
