CVE-2026-20262

Think of Cisco Catalyst SD-WAN Manager as the “control room” that manages your network connectivity. This vulnerability is like letting a logged-in attacker trick the system into placing or replacing files anywhere on the server. In the worst case, that attacker can then turn that file access into full control of the device.

This matters if your business runs Cisco Catalyst SD-WAN Manager (Catalyst SD-WAN Manager) and someone can log in to its web interface with a valid account. Because exploitation requires authentication, the risk is highest where accounts are weak, shared, or accessible from the broader internet. This is only a risk if the attacker can reach the manager’s web UI/API and has valid credentials with at least a lower-privileged, single-task user account.

This is RED because it’s confirmed as a real-world risk: it is listed in CISA KEV and added on 2026-06-15, with a CISA remediation due date of 2026-06-29. There is also a public exploit available, meaning attackers can act quickly once they have the needed login access.

1. Confirm exposure (asset/version check)

   • Identify every deployed instance of Cisco Catalyst SD-WAN Manager in your environment.
   • For each instance, record the current software version.
   • Determine whether your version is earlier than 20.9.9.2. If it is, you should treat the instance as vulnerable until upgraded.

2. Verify access path (reachability)

   • Confirm whether the Catalyst SD-WAN Manager web UI/API is reachable from the public internet.
   • Confirm which networks/allowlists can reach the management interface.
   • Ensure there is no unintended exposure that would let an attacker attempt login from outside your intended management networks.

3. Upgrade to the fixed version

   • Upgrade Catalyst SD-WAN Manager to 20.9.9.2 (or later).
   • Follow Cisco’s upgrade procedure for this platform to avoid operational disruption.

4. If you cannot upgrade before CISA’s due date

   • Follow Cisco’s mitigation guidance from the advisory.
   • Immediately restrict access to the web UI/API to trusted management networks only (and remove public internet access).
   • Review all accounts: disable unused users, enforce strong passwords, and reduce the number of active lower-privileged accounts.

5. Post-upgrade validation

   • Re-check the running version shows 20.9.9.2 or later.
   • Validate that the manager is reachable only from approved networks.

6. What to monitor

   • Web/app logs for unusual file upload activity (especially repeated uploads, unexpected filenames/paths, or abnormal request patterns).
   • Admin/audit logs for logins by accounts that normally do not perform uploads.
   • Signs of unexpected privileged changes (as privilege escalation is a key consequence of this issue).

Severity is effectively high for operations because the flaw allows an authenticated attacker to create or overwrite arbitrary files on the underlying filesystem (CWE-22 improper input validation / path handling around file uploads in the web UI). The attack vector is network-based via crafted HTTP requests to an affected API endpoint; no user interaction is required. Exploitation requires valid credentials with at least a lower-privileged, single-task user account. CISA KEV indicates real-world relevance; the vulnerability is listed in KEV with a remediation due date of 2026-06-29. A public exploit is available, and press attention is rising; the EPSS score is predictive (7.7% with a rising trend) and is not the basis for urgency given KEV confirmation. The practical impact includes privilege escalation to root, followed by potential full device/system compromise and SD-WAN control disruption.