{"id":"cisco-sdwan-path-traversal-attacks-feb-2026","category":"patch","status":"closed","title":"Cisco SD-WAN privilege-escalation flaw CVE-2022-20775 used in attacks","tldr":"Attackers used an old Cisco SD-WAN flaw to gain full control after obtaining access. It affects business network equipment. Ask your network provider to install a current fixed release and investigate for existing compromise.","summary":"CVE-2022-20775 is a flaw in Cisco SD-WAN's command-line controls that lets an authenticated local attacker run commands with full system privileges. It affects business network infrastructure. Cisco published fixes in September 2022, but acknowledged attempted exploitation in February 2026. CISA listed it as exploited on 25 February, while Cisco Talos linked its use to UAT-8616, a group targeting high-value organisations, including critical infrastructure. Talos reported that a separate authentication bypass provided initial access. Fixes remain available; older affected release branches require migration. As at 3 November 2026, Cisco's advisory has no revision after 25 February. Patching must be accompanied by checks for existing compromise.","action":"If your business or family office uses Cisco SD-WAN, ask its network provider to install a current Cisco-recommended fixed release and check for unauthorised accounts, keys and connections using Cisco's investigation guidance. Historical fixes for this flaw start at 20.6.3, 20.7.2 and 20.8.1; older affected branches require migration.","product":"Cisco SD-WAN network controllers, management software and vEdge routers","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2022-20775"],"tags":["cisco","sd-wan","network","privilege-escalation","actively-exploited"],"affected":["Cisco SD-WAN vBond Orchestrator Software, vEdge Cloud Routers, vEdge Routers, vManage Software and vSmart Controller Software running affected Cisco SD-WAN releases.","Affected release branches: 18.4 and earlier, 19.2, 20.3, 20.6 before 20.6.3, 20.7 before 20.7.2, and 20.8 before 20.8.1. Cisco lists 20.9 as unaffected and excludes Cisco IOS XE SD-WAN Software."],"fixed":["Cisco SD-WAN Software 20.6.3","Cisco SD-WAN Software 20.7.2","Cisco SD-WAN Software 20.8.1"],"matches":[],"sources":[{"kind":"advisory","title":"Cisco SD-WAN Software Privilege Escalation Vulnerabilities","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF","by":"Cisco","date":"2026-02-25"},{"kind":"research","title":"Active exploitation of Cisco Catalyst SD-WAN by UAT-8616","url":"https://blog.talosintelligence.com/uat-8616-sd-wan/","by":"Cisco Talos","date":"2026-02-25"},{"kind":"advisory","title":"CVE-2022-20775 Detail","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-20775","by":"NIST","date":"2026-06-17"}],"started":"2026-02-25","closed":"2026-02-25","created":"2026-11-03T22:30:58.180Z","updated":"2026-11-03T22:30:58.180Z","cve_notes":[{"cve":"CVE-2022-20775","name":"Cisco SD-WAN CLI path traversal to root privileges","what":"Inadequate access controls in Cisco SD-WAN's command-line interface let an authenticated local attacker execute commands as root, gaining full system privileges.","severity":"high","cvss":7.8}],"timeline":[{"at":"2026-02-25T20:29Z","added":"2026-11-03T22:24:44.025Z","kind":"vendor-revised","text":"Cisco updated its advisory to acknowledge attempted exploitation during February 2026 and renewed its recommendation to upgrade.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF","by":"Cisco","patch":null},{"at":"2026-02-25","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"Cisco Talos reported that UAT-8616 used the flaw to obtain root access after a separate SD-WAN authentication bypass. The wider campaign's activity dated back to at least 2023; Talos did not date this flaw's first use separately.","url":"https://blog.talosintelligence.com/uat-8616-sd-wan/","by":"Cisco Talos","patch":null},{"at":"2026-02-25","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added CVE-2022-20775 to its Known Exploited Vulnerabilities catalogue, with a 27 February deadline for US federal civilian agencies to act.","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-20775","by":"NIST","patch":null},{"at":"2022-09-29","added":"2026-11-03T22:24:44.025Z","kind":"vendor-revised","text":"Cisco corrected the first fixed 20.6 release from 20.6.4 to 20.6.3.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF","by":"Cisco","patch":null},{"at":"2022-09-28","added":"2026-11-03T22:24:44.025Z","kind":"disclosed","text":"Cisco disclosed CVE-2022-20775 and published fixed-release information. The flaw lets an authenticated local attacker gain root privileges.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF","by":"Cisco","patch":"patched"}],"url":"https://hard.fyi/live/cisco-sdwan-path-traversal-attacks-feb-2026/","json":"https://hard.fyi/api/live?id=cisco-sdwan-path-traversal-attacks-feb-2026"}