CVE Tools
Track your stack

Cisco Releases Security Updates for Actively Exploited SD-WAN Manager Flaw

The Hacker NewsBy The Hacker News

Reported exploitedCatalyst SD-WAN ManagerUAT-8616vManage

Our summary

Cisco has released security updates for CVE-2026-20262, a medium-severity vulnerability in the web UI of Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) that is being actively exploited in the wild. The issue can let an authenticated remote attacker abuse a file upload path-handling weakness to create or overwrite files on the device’s filesystem, which may be leveraged toward higher privileges depending on attacker access. The fix is available across multiple Cisco Catalyst SD-WAN releases, including Cisco Catalyst SD-WAN Release 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, and 26.1.1.2, covering Cisco Catalyst SD-WAN Manager On-Prem, Cisco SD-WAN Cloud-Pro, Cisco SD-WAN Cloud (Cisco Managed), and Cisco SD-WAN for Government (FedRAMP).

Read at The Hacker News

The Hacker News publishes this story on its own site; we link to it rather than reprint it.

  1. SecurityWeekCisco Patches Another SD-WAN Zero-Day Exploited in AttacksCVE-2022-20775, CVE-2026-20122 +6
  2. The Hacker NewsCisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch AvailableCVE-2022-20775, CVE-2026-20122 +5
  3. SecurityWeekCisco Warns of 7th SD-WAN Zero-Day Exploited in 2026CVE-2022-20775, CVE-2026-20122 +5
  4. BleepingComputerCisco fixes SD-WAN vManage flaw exploited in zero-day attacksCVE-2026-20122, CVE-2026-20128 +4
  5. BleepingComputerCisco warns of unpatched SD-WAN zero-day exploited in attacksCVE-2026-20122, CVE-2026-20127 +4
  6. Cisco TalosOngoing exploitation of Cisco Catalyst SD-WAN vulnerabilitiesCVE-2026-20122, CVE-2026-20127 +3
  7. SecurityWeekCisco SD-WAN Zero-Day Exploited Months Before PatchingCVE-2026-20127, CVE-2026-20182 +1
  8. The Hacker NewsCisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root AccessCVE-2026-20127, CVE-2026-20182 +1
  9. BleepingComputerMandiant reveals how Cisco SD-WAN zero-day attacks gained root accessCVE-2026-20127, CVE-2026-20182 +1
  10. Dark ReadingAttackers Hit Cisco SD-WAN Flaw 2 Months Before DisclosureCVE-2026-20127, CVE-2026-20182 +1

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store