CVE-2026-20262
Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability
Description
CVE-2026-20262 is a path traversal vulnerability in the web UI of Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) that allows an authenticated, remote attacker to create a file or overwrite any file on the filesystem. The flaw exists because the affected software does not properly validate user-supplied input during a file upload process, so a crafted HTTP request to an API endpoint can write to arbitrary paths. An attacker only needs a low-privileged, single-task user account, and the written file can later be used to elevate to root. CVE-2026-20262 is rated CVSS 6.5 (Medium) and is listed in the CISA KEV catalog. Because this path traversal vulnerability provides a stepping stone to root on a critical network management platform, affected Cisco SD-WAN deployments should be patched promptly.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | catalyst sd-wan manager | < 20.9.9.2; >= 20.10, < 20.12.7.2; >= 20.13, < 20.15.4.5; >= 20.15.5, < 20.15.5.3; >= 20.16, < 20.18.3.1; >= 26.1, < 26.1.1.2 |
References
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-20262 is classified under CWE-22 — Path Traversal. Cisco Catalyst SD-WAN Manager builds a file path from user-supplied upload input without properly neutralizing traversal sequences, so the resolved path can escape the intended directory and point anywhere on the filesystem. This lets an authenticated attacker create or overwrite files outside the directory the upload feature was meant to be confined to.
Learn more: CWE-22 — Path Traversal
Impact Analysis
CVE-2026-20262 carries a CVSS 3.1 base score of 6.5 (Medium). Attack Vector (Network): the web UI and API endpoint are reachable remotely. Attack Complexity (Low): the crafted request requires no special conditions. Privileges Required (Low): the attacker needs only a low-privileged, single-task user account. User Interaction (None): no victim action is required. Integrity (High) with Confidentiality (None) and Availability (None): the direct impact is the ability to create or overwrite arbitrary files, which on its own does not expose data or stop the service, but the written file can subsequently be used to elevate privileges to root. With an EPSS score of about 1.1% (63rd percentile) and confirmed inclusion in the KEV catalog, organizations should treat the medium base score as understating the real risk, since arbitrary file write on a network controller is a common path to full device takeover.
Exploit Maturity
CISA has added CVE-2026-20262 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The references list only the Cisco vendor advisory and the KEV entry, with no dedicated public exploit link, and the EPSS score is about 1.1% (63rd percentile). Even so, given confirmed exploitation and the fact that arbitrary file write on a network management platform readily chains to root, defenders should prioritize patching rather than rely on the medium EPSS figure.
Remediation
- Follow CISA's required action and upgrade Cisco Catalyst SD-WAN Manager to a fixed release per the Cisco security advisory; fixed trains include 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, and 26.1.1.2.
- Identify the exact running version and choose the corresponding fixed release from the affected version ranges to ensure the upgrade actually remediates the flaw.
- As an interim mitigation, restrict access to the SD-WAN Manager web UI and API to trusted management networks and tighten role assignments so untrusted users cannot obtain even low-privileged accounts.
- Review audit logs for unexpected file uploads and for files written outside expected directories, and check for signs of subsequent privilege escalation.
- As long-term hardening, validate upload paths against an allowlist and resolve canonical paths before writing, ensuring the result stays within the intended directory (per the CWE-22 guidance).
Technical Details
The vulnerability is an instance of CWE-22 (Path Traversal): the file upload process in Cisco Catalyst SD-WAN Manager fails to neutralize special path elements such as "../" in user-supplied input, so the constructed pathname can resolve outside the restricted upload directory. As captured by the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, an authenticated low-privilege user sends a crafted HTTP request to the affected API endpoint and writes a file to an arbitrary location with the privileges of the affected component. Because that file can be placed where it will later be executed or read by a privileged process, the path traversal becomes a route to root-level compromise of the underlying operating system.
Frequently Asked Questions
Is CVE-2026-20262 being actively exploited?
Yes. CVE-2026-20262 is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation. Its EPSS score is about 1.1% (63rd percentile), but the KEV listing is the decisive signal.
What products are affected by CVE-2026-20262?
Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) is affected across multiple trains, including versions below 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, and 26.1.1.2.
How do I fix CVE-2026-20262?
Upgrade Cisco Catalyst SD-WAN Manager to a fixed release as documented in the Cisco security advisory, choosing the fixed version that corresponds to your current train. Restrict access to the management interface in the meantime.
How severe is CVE-2026-20262?
It is rated Medium with a CVSS 3.1 base score of 6.5, but the impact is more serious in practice because the arbitrary file write can be used to elevate to root, and the vulnerability is confirmed as actively exploited.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.