CVE-2026-20122
Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability
Description
CVE-2026-20122 is a HIGH severity vulnerability in Cisco Catalyst SD-WAN Manager (formerly vManage) caused by incorrect use of privileged APIs, classified under CWE-269 (Improper Privilege Management). The flaw exists in the API interface's file handling logic, where insufficient authorization checks allow an authenticated attacker to upload a malicious file to arbitrary locations on the local filesystem of the SD-WAN Manager node, overwrite critical system files, and escalate privileges to the vmanage user account. Because Cisco SD-WAN Manager is the centralized orchestration and policy management plane for enterprise SD-WAN deployments, a successful exploit grants an attacker control over the entire SD-WAN fabric, including routing policies, VPN configurations, and connected branch endpoints. CISA added CVE-2026-20122 to the Known Exploited Vulnerabilities (KEV) catalog on April 20, 2026, and issued Emergency Directive 26-03 requiring federal agencies to remediate by April 23, 2026 — a three-day window reflecting the critical risk to national network infrastructure. CVE-2026-20122 is part of a cluster of three SD-WAN Manager vulnerabilities addressed under ED 26-03, alongside CVE-2026-20133 and CVE-2026-20128. The EPSS score is 0.01124, placing this vulnerability at the 78.3rd percentile of all CVEs — indicating elevated exploitation probability relative to the overall CVE population.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | catalyst sd-wan manager | < 20.9.8.2; >= 20.10, < 20.12.5.3; >= 20.13, < 20.15.4.2; >= 20.16, < 20.18.2.1; 20.12.6 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
References
Weakness Type
CWE-269: Improper Privilege Management
CWE-269 describes software that does not properly assign, modify, track, or check privileges for an actor, enabling unauthorized access to privileged operations or resources. In the context of CVE-2026-20122, the vulnerability manifests in Cisco SD-WAN Manager's API layer, where a privileged internal API endpoint responsible for filesystem operations can be invoked without the caller first undergoing adequate authorization checks. Rather than verifying that the calling identity holds the specific elevated privilege required for filesystem writes and privilege escalation, the API assumes correct access control has already occurred at an upstream layer — a classic confused-deputy pattern that can be exploited when the upstream check is bypassed or the API is reached via an unexpected code path.
The practical consequence is that an authenticated attacker with lower-privileged credentials can call the privileged file-upload API, place attacker-controlled content at arbitrary paths on the SD-WAN Manager's local filesystem, overwrite configuration or executable files, and ultimately attain vmanage-level user privileges. Privilege escalation to vmanage is particularly severe because vmanage is the superuser role in Cisco SD-WAN Manager, with the ability to modify global routing policy, VPN topology, device templates, and authentication settings for all connected SD-WAN routers. Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
No official NVD CVSS score has been published for CVE-2026-20122 at the time of writing; the following analysis is based on the vulnerability's technical characteristics, the CISA Emergency Directive 26-03 classification, and contextual comparison with similar Cisco SD-WAN vulnerabilities.
Attack Vector (Network): The vulnerability is exploitable remotely over the network via the SD-WAN Manager's exposed API interface, which is typically accessible to SD-WAN administrators and, in misconfigured deployments, may be reachable from broader network segments.
Attack Complexity (Low): Exploitation does not require special race conditions, timing dependencies, or complex environment preparation beyond possessing valid credentials. The attacker simply crafts an API request that calls the privileged endpoint with a malicious file payload.
Privileges Required (Low): A standard authenticated user account is sufficient to trigger the vulnerability — no administrative privileges are needed to initiate the attack, making the vulnerability accessible to compromised low-privilege accounts or insider threats.
User Interaction (None): No action is required from another user; the attacker operates entirely autonomously after authentication.
Scope and Impact: The vulnerability crosses a privilege boundary (low user to vmanage superuser), representing a complete compromise of the SD-WAN Manager's authorization model. Confidentiality, integrity, and availability of the SD-WAN fabric are all HIGH: the attacker can exfiltrate routing configurations and credentials, modify the SD-WAN topology, redirect traffic, and disrupt connectivity across all managed branch sites.
Prioritization Guidance: The combination of KEV listing with an Emergency Directive and a three-day remediation window (April 20–23, 2026), the 78.3rd percentile EPSS score, and the critical network-infrastructure role of Cisco SD-WAN Manager demands immediate remediation. Organizations should treat this as a zero-day response regardless of whether official patches are available.
Exploit Maturity
KEV Listing and Emergency Directive: CVE-2026-20122 was added to CISA's Known Exploited Vulnerabilities catalog on April 20, 2026, and is covered under Emergency Directive 26-03 — one of the most urgent CISA response mechanisms, reserved for vulnerabilities actively exploited against or posing severe risk to federal infrastructure. The three-day remediation window (due April 23, 2026) is significantly shorter than the standard 15-day KEV deadline and signals confirmed, time-sensitive exploitation activity.
EPSS Context: The EPSS score of 0.01124 (78.3rd percentile) is noteworthy: while the raw probability appears low, the 78.3rd percentile placement means this vulnerability ranks in the top quarter of all CVEs by predicted exploitation probability. For network infrastructure vulnerabilities affecting centralized management planes, even modest EPSS scores can translate to material risk given attacker interest in SD-WAN environments as force-multiplier targets.
Cluster Exploitation Pattern: CVE-2026-20122 is part of a three-CVE cluster (with CVE-2026-20133 and CVE-2026-20128) that collectively enable reconnaissance, credential theft, and privilege escalation against Cisco SD-WAN Manager. This clustering suggests coordinated exploitation by a sophisticated threat actor or structured attack tooling targeting Cisco SD-WAN deployments.
Ransomware: No known ransomware campaigns have been specifically attributed to CVE-2026-20122 at the time of writing; however, the vmanage privilege escalation capability it provides is highly attractive to ransomware operators seeking to encrypt branch-site configurations and disrupt network operations at scale.
Public PoC: No public proof-of-concept exploit code has been confirmed as of April 24, 2026, consistent with the fresh disclosure date and the Emergency Directive timeline.
Remediation
-
Comply with CISA Emergency Directive 26-03. Federal civilian executive branch (FCEB) agencies must remediate CVE-2026-20122 by April 23, 2026 per ED 26-03. All organizations operating Cisco Catalyst SD-WAN Manager should treat this deadline as a best-practice target given active exploitation risk.
-
Apply Cisco security patches immediately. Monitor Cisco's Security Advisory for CVE-2026-20122 (available at tools.cisco.com/security/center) and apply the patched SD-WAN Manager software release as soon as it is published. Follow Cisco's upgrade guide for your SD-WAN Manager deployment (standalone or cluster).
-
Restrict API access as an interim mitigation. If patching is not immediately possible, restrict access to the SD-WAN Manager API interface using ACLs, firewall rules, or network segmentation. Limit API access to known administrative IP ranges and enforce VPN or jump-host access for all management-plane connections. Disable unused API endpoints where the vendor guidance permits.
-
Audit authentication and authorization logs. Review SD-WAN Manager audit logs for unexpected API calls, file-upload operations, or privilege changes — particularly any events involving the vmanage user account that were not initiated by known administrators. Look for anomalous login timestamps, source IPs, or API endpoints in the management logs.
-
Implement anomaly detection for SD-WAN management traffic. Configure alerting for privilege escalation events, unexpected file modifications on the SD-WAN Manager filesystem, and unusual API call patterns. Correlate with SIEM data to detect lateral movement from a compromised SD-WAN Manager to connected SD-WAN routers.
-
Harden the SD-WAN Manager deployment. Apply the principle of least privilege to all SD-WAN Manager user accounts. Remove unused accounts, enforce multi-factor authentication on all management interfaces, and segment the management plane so that SD-WAN Manager is not reachable from untrusted networks. Regularly review API authorization policies and apply vendor hardening guides.
Technical Details
CVE-2026-20122 resides in the API interface of Cisco Catalyst SD-WAN Manager, the centralized management, policy, and orchestration component of the Cisco SD-WAN (formerly Viptela) architecture.
Root Cause — Privileged API Misconfiguration: The vulnerability stems from an internal API endpoint designed for file management operations (such as configuration uploads, software image staging, or template file handling) that enforces insufficient authorization before processing caller-supplied file content and destination path parameters. The API operates with the privileges of the vmanage system user but does not validate that the caller holds an equivalent privilege level. This is a privilege-management failure rather than a traditional injection flaw: the API is functioning as designed, but the design failed to scope its access correctly.
Attack Mechanics: An authenticated attacker (any valid SD-WAN Manager credential) sends a crafted HTTP request to the vulnerable API endpoint, supplying an attacker-controlled file payload and a path parameter that resolves to a location outside of any expected upload directory — for example, overwriting a startup script, a cron job, or a configuration file used by a privileged process. Because the API runs with vmanage-level privileges, the written file is owned and executable by vmanage. By placing a malicious script or binary in an auto-executed location, the attacker achieves persistent code execution as the vmanage superuser.
Cluster Context: This CVE was disclosed alongside CVE-2026-20133 (sensitive information disclosure) and CVE-2026-20128, all affecting Cisco Catalyst SD-WAN Manager. CISA grouped all three under Emergency Directive 26-03, indicating a coordinated exploitation scenario where information disclosure (CVE-2026-20133) may be used to harvest credentials or session tokens that facilitate the privilege escalation in CVE-2026-20122.
Vendor References: Consult the Cisco Security Advisory at tools.cisco.com/security/center for affected software versions, fixed releases, and workaround guidance. Also review CISA Emergency Directive 26-03 at cisa.gov for federal compliance requirements.
Frequently Asked Questions
Is CVE-2026-20122 being actively exploited?
Yes. CISA added CVE-2026-20122 to the KEV catalog on April 20, 2026, and issued Emergency Directive 26-03 with a three-day remediation deadline, which is one of the strongest signals CISA issues for active, time-sensitive exploitation. Organizations operating Cisco Catalyst SD-WAN Manager should assume exploitation is occurring and treat remediation as an emergency response.
What products are affected?
Cisco Catalyst SD-WAN Manager (formerly vManage) is the affected product. Consult the Cisco Security Advisory for the specific software versions that contain the vulnerability. Other components of the Cisco SD-WAN solution (routers running IOS XE SD-WAN, vBond, vSmart) are not directly vulnerable but are at risk if the SD-WAN Manager is compromised.
How do I fix it?
Apply the Cisco-issued patch for CVE-2026-20122 as soon as it is available via the Cisco Security Advisory portal. As an interim measure, restrict API access to the SD-WAN Manager to known administrative IP ranges and enforce VPN/jump-host access for all management connections. Review audit logs for signs of exploitation immediately.
How severe is it?
CVE-2026-20122 is rated HIGH severity. While no formal NVD CVSS score has been published yet, the combination of remote exploitability, low privilege requirement, no user interaction, privilege escalation to the vmanage superuser, and its listing under a CISA Emergency Directive makes this one of the most operationally dangerous vulnerabilities disclosed in April 2026 for organizations using Cisco SD-WAN infrastructure.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.