{"id":"cisco-sdwan-manager-file-write-jun-2026","category":"patch","status":"closed","title":"Cisco Catalyst SD-WAN Manager file-write flaw CVE-2026-20262 exploited; fixes available","tldr":"Attackers used CVE-2026-20262 to create or overwrite files on Cisco Catalyst SD-WAN Manager, potentially gaining full control. Organisations should preserve diagnostic logs, contact Cisco support and install the fixed release for their branch.","summary":"Cisco disclosed CVE-2026-20262 on 15 June after becoming aware of limited exploitation that month. The flaw affects the web management interface of Catalyst SD-WAN Manager, formerly vManage, across on-premises and cloud deployment types. An attacker needs valid credentials with write access; the flaw lets them create or overwrite files, potentially leading to full administrator control. CISA listed it as exploited the same day. Cisco has released fixes for all release branches and offers no workaround. Its remediation guide, updated on 1 July, also identifies a separate fixed version for Cisco-hosted clusters. Administrators should preserve diagnostic evidence and have Cisco support assess possible compromise: installing an update does not remove an existing intrusion. The reviewed sources do not establish that attacks have ended or identify affected organisations.","action":"Nothing for you to do on ordinary household devices; this affects business network management software. If your business or family office uses Cisco Catalyst SD-WAN Manager, ask its IT provider to preserve diagnostic files before changes, contact Cisco TAC for a compromise assessment and install the fixed release listed for its branch. Any confirmed intrusion needs further remediation under Cisco’s guidance.","product":"Cisco Catalyst SD-WAN Manager (formerly vManage)","audience":"work","severity":"medium","patch":"patched","exploited":true,"cves":["CVE-2026-20262"],"tags":["cisco","sd-wan","path-traversal","file-write","exploited"],"affected":["Cisco Catalyst SD-WAN Manager: all deployment types, regardless of device configuration","20.9.9.1 and earlier","20.12.7.1 and earlier","20.15.4.4 and earlier","20.15.5.2 and earlier","20.18.3","26.1.1.1 and earlier"],"fixed":["20.9.9.2","20.12.7.2","20.15.4.5","20.15.5.3","20.18.3.1","26.1.1.2","20.15.507 (Cisco-Hosted Cluster deployments only)"],"matches":[],"sources":[{"kind":"advisory","title":"Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ","by":"Cisco","date":"2026-06-15"},{"kind":"advisory","title":"Remediate Catalyst SD-WAN Security Advisory - June 2026","url":"https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/226014-remediate-catalyst-sd-wan-security.html","by":"Cisco","date":"2026-07-01"},{"kind":"advisory","title":"Cisco security advisory (AV26-602)","url":"https://www.cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-602","by":"Canadian Centre for Cyber Security","date":"2026-06-15"},{"kind":"news","title":"Cisco discloses second exploited SD-WAN vulnerability in two weeks (CVE-2026-20262)","url":"https://www.helpnetsecurity.com/2026/06/16/cisco-sd-wan-cve-2026-20262-exploited/","by":"Help Net Security","date":"2026-06-17"}],"started":"2026-06-15","closed":"2026-07-01","created":"2026-11-03T22:24:31.710Z","updated":"2026-11-03T22:24:31.710Z","cve_notes":[{"cve":"CVE-2026-20262","name":"Path traversal file write in Cisco SD-WAN Manager","what":"Inadequate validation during file uploads in Cisco Catalyst SD-WAN Manager’s web interface lets a remote attacker with valid write-access credentials create or overwrite system files, potentially gaining full administrator control.","severity":"medium","cvss":6.5}],"timeline":[{"at":"2026-07-01","added":"2026-11-03T22:22:59.664Z","kind":"vendor-revised","text":"Cisco added 20.15.507 as a fixed release specifically for Cisco-Hosted Cluster deployments. Its guide warns that updating alone does not resolve a confirmed compromise.","url":"https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/226014-remediate-catalyst-sd-wan-security.html","by":"Cisco","patch":null},{"at":"2026-06-22","added":"2026-11-03T22:22:59.664Z","kind":"vendor-revised","text":"Cisco updated its remediation guide with verification steps for releases older than 20.9.","url":"https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/226014-remediate-catalyst-sd-wan-security.html","by":"Cisco","patch":null},{"at":"2026-06-17","added":"2026-11-03T22:22:59.664Z","kind":"other","text":"Cisco told Help Net Security that the same software fix addresses this flaw and the SD-WAN privilege-escalation vulnerability disclosed earlier in June.","url":"https://www.helpnetsecurity.com/2026/06/16/cisco-sd-wan-cve-2026-20262-exploited/","by":"Help Net Security","patch":null},{"at":"2026-06-15T22:00Z","added":"2026-11-03T22:22:59.664Z","kind":"vendor-revised","text":"Cisco clarified that exploitation requires credentials with at least write access and added context for assessing suspicious activity in logs.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ","by":"Cisco","patch":null},{"at":"2026-06-15T16:00Z","added":"2026-11-03T22:22:59.664Z","kind":"disclosed","text":"Cisco disclosed CVE-2026-20262, confirmed limited exploitation in June and listed fixed software releases. The flaw allows a logged-in attacker to create or overwrite files.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ","by":"Cisco","patch":"patched"},{"at":"2026-06-15","added":"2026-11-03T22:22:59.664Z","kind":"cisa-added","text":"CISA added CVE-2026-20262 to its Known Exploited Vulnerabilities catalogue, as confirmed by the Canadian Centre for Cyber Security.","url":"https://www.cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-602","by":"Canadian Centre for Cyber Security","patch":null}],"url":"https://hard.fyi/live/cisco-sdwan-manager-file-write-jun-2026/","json":"https://hard.fyi/api/live?id=cisco-sdwan-manager-file-write-jun-2026"}