Patch Cisco SD-WAN Manager before CVE-2026-20262 turns into root access

Confirmed: Cisco says CVE-2026-20262 affects Cisco Catalyst SD-WAN Manager and allows an authenticated remote attacker with write access to create or overwrite files on the underlying operating system. Cisco also says PSIRT became aware of limited exploitation in June 2026. CISA has added the flaw to its Known Exploited Vulnerabilities catalog, so this is a patch-and-investigate item, not a routine backlog ticket.

What changed

Cisco published fixes for an arbitrary file-write vulnerability in Catalyst SD-WAN Manager, formerly SD-WAN vManage. The issue sits in the web UI file upload path and can be exploited through a crafted HTTP request to an affected API endpoint.

The attacker needs valid credentials with at least write access. That lowers the exposure compared with unauthenticated remote code execution, but it does not make the bug low-risk. Cisco says a successful file write could later be used to elevate to root, and all deployment types listed in the advisory were affected at publication time.

Key takeaways

• Inventory every Catalyst SD-WAN Manager instance, including cloud, government, and on-prem deployments.
• Upgrade to the fixed release train Cisco lists for your current version.
• Review SD-WAN Manager logs for suspicious WAR upload and deployment activity.
• Treat internet-exposed management ports as higher priority for triage.
• If logs are ambiguous, Cisco recommends opening a TAC case with admin-tech data.

Availability and access

Cisco says software updates are available and that there are no workarounds for the vulnerability. The fixed-version matrix lives in Cisco's advisory and should be treated as the source of record because Cisco can revise affected and fixed releases after publication.

CISA's KEV listing means US federal civilian agencies received a remediation deadline. Private teams should still use the KEV signal as prioritization evidence, especially if SD-WAN Manager is reachable from untrusted networks or if privileged accounts have recently changed hands.

Practical LinkLoot angle

The useful move is a short incident-style checklist, even if you already patched. Confirm the version, export the relevant logs, search for suspicious upload and deployment events, and compare the source IPs against expected administrative access.

For teams using automated security runbooks, write the product name, CVE, fixed release, and log locations directly into the ticket. That gives AI-assisted triage tools enough context to avoid generic "patch Cisco" advice and focus on the SD-WAN Manager evidence trail. LinkLoot's AI workflow automation guide is a useful place to frame those checks without turning the response into blind automation.

What to verify before you act

• Confirm the exact Catalyst SD-WAN Manager release and match it to Cisco's fixed-version table.
• Check whether management interfaces or related ports are exposed to the internet.
• Audit /var/log/nms/vmanage-server.log for unexpected file upload paths.
• Review vmanage-appserver.log and service proxy access logs for suspicious WAR deployment or JSP access.
• Confirm whether the same fixed release also addresses related SD-WAN Manager flaws in your environment.

Source check

Confirmed by:

• Cisco's advisory confirms the affected product, the authenticated arbitrary file-write impact, no workaround, available fixed software, and limited exploitation observed by PSIRT.
• CISA's KEV catalog lists CVE-2026-20262 as a known exploited vulnerability, according to the public catalog entry surfaced in search and cited by independent coverage.

Independent context:

• Help Net Security summarizes Cisco's advisory, notes CISA's KEV addition, and reports Cisco's later statement that the fix overlaps with the related CVE-2026-20245 release train.