Cisco Catalyst SD-WAN Manager file-write flaw CVE-2026-20262 exploited; fixes available
Attackers used CVE-2026-20262 to create or overwrite files on Cisco Catalyst SD-WAN Manager, potentially gaining full control. Organisations should preserve diagnostic logs, contact Cisco support and install the fixed release for their branch.
Nothing for you to do on ordinary household devices; this affects business network management software. If your business or family office uses Cisco Catalyst SD-WAN Manager, ask its IT provider to preserve diagnostic files before changes, contact Cisco TAC for a compromise assessment and install the fixed release listed for its branch. Any confirmed intrusion needs further remediation under Cisco’s guidance.
What’s happening
Cisco disclosed CVE-2026-20262 on 15 June after becoming aware of limited exploitation that month. The flaw affects the web management interface of Catalyst SD-WAN Manager, formerly vManage, across on-premises and cloud deployment types. An attacker needs valid credentials with write access; the flaw lets them create or overwrite files, potentially leading to full administrator control. CISA listed it as exploited the same day. Cisco has released fixes for all release branches and offers no workaround. Its remediation guide, updated on 1 July, also identifies a separate fixed version for Cisco-hosted clusters. Administrators should preserve diagnostic evidence and have Cisco support assess possible compromise: installing an update does not remove an existing intrusion. The reviewed sources do not establish that attacks have ended or identify affected organisations.
- What
- Flaw
- Affects
- Cisco Catalyst SD-WAN Manager (formerly vManage)
- Affected
- Cisco Catalyst SD-WAN Manager: all deployment types, regardless of device configuration
20.9.9.1 and earlier
20.12.7.1 and earlier
20.15.4.4 and earlier
20.15.5.2 and earlier
20.18.3
26.1.1.1 and earlier - Fixed in
- 20.9.9.2
20.12.7.2
20.15.4.5
20.15.5.3
20.18.3.1
26.1.1.2
20.15.507 (Cisco-Hosted Cluster deployments only) - Since
- 15 June 2026
- Closed
- 1 July 2026
Timeline
- Vendor revised
Cisco added 20.15.507 as a fixed release specifically for Cisco-Hosted Cluster deployments. Its guide warns that updating alone does not resolve a confirmed compromise.
- Vendor revised
Cisco updated its remediation guide with verification steps for releases older than 20.9.
- Update
Cisco told Help Net Security that the same software fix addresses this flaw and the SD-WAN privilege-escalation vulnerability disclosed earlier in June.
- Vendor revised
Cisco clarified that exploitation requires credentials with at least write access and added context for assessing suspicious activity in logs.
- Made publicFixed
Cisco disclosed CVE-2026-20262, confirmed limited exploitation in June and listed fixed software releases. The flaw allows a logged-in attacker to create or overwrite files.
- CISA added
CISA added CVE-2026-20262 to its Known Exploited Vulnerabilities catalogue, as confirmed by the Canadian Centre for Cyber Security.
Sources
- Cisco Catalyst SD-WAN Manager Arbitrary File Write VulnerabilityCisco · 15 June 2026
- Remediate Catalyst SD-WAN Security Advisory - June 2026Cisco · 1 July 2026
- Cisco security advisory (AV26-602)Canadian Centre for Cyber Security · 15 June 2026
- Cisco discloses second exploited SD-WAN vulnerability in two weeks (CVE-2026-20262)Help Net Security · 17 June 2026