Cisco Releases Updates for Actively Exploited SD-WAN Manager Vulnerability

Cisco has released security updates to address CVE-2026-20262, a vulnerability affecting Cisco Catalyst SD-WAN Manager (formerly vManage) that is being actively exploited in the wild. The flaw could allow an authenticated attacker to create or overwrite files on affected systems, potentially leading to root-level privilege escalation and complete system compromise. Cisco has confirmed observing limited exploitation of this vulnerability and strongly recommends customers upgrade to fixed software versions immediately.

Cisco SD-WAN Manager serves as the centralized management platform for SD-WAN deployments, allowing administrators to manage thousands of network devices from a single console.

Vulnerability Details

CVE ID: CVE-2026-20262
CVSS Score: 6.5 (Medium)
Affected Product: Cisco Catalyst SD-WAN Manager
Vulnerability Type: Arbitrary File Write / Path Traversal
Attack Vector: Authenticated Remote Exploitation

The flaw arises from improper handling of file upload requests in Cisco SD-WAN Manager. An attacker possessing valid credentials and write privileges can exploit the vulnerability to write arbitrary files to the system, which may subsequently be used to elevate privileges and gain full administrative control of the device.

Why This Matters

A successful compromise could enable attackers to:

• Escalate privileges to root level
• Deploy malicious code on the SD-WAN Manager
• Modify network configurations
• Establish persistent access
• Move laterally across connected environments
• Potentially disrupt business-critical network operations

Affected Deployments

• Cisco Catalyst SD-WAN Manager On-Prem
• Cisco SD-WAN Cloud-Pro
• Cisco SD-WAN Cloud (Cisco Managed)
• Cisco SD-WAN for Government (FedRAMP)

Observed Attacker Activity

According to Cisco, attackers have been observed:

• Uploading malicious .war files to vulnerable systems
• Leveraging the WildFly application server to deploy malicious web applications
• Executing commands through HTTP POST requests
• Establishing persistence through deployed web shells and malicious applications

These activities could allow attackers to maintain long-term access and execute arbitrary commands on compromised systems.

Indicators of Compromise (IoCs)

• Suspicious .war file uploads
• Unexpected application deployments within the WildFly environment
• Unusual HTTP POST requests targeting newly deployed web applications
• Unexplained file creation or modification on SD-WAN Manager systems
• Privileged account activity outside normal operating patterns

Recommendations

1. Upgrade Cisco Catalyst SD-WAN Manager to a fixed software release.
2. Review system logs for indicators of compromise.
3. Identify and investigate suspicious file uploads.
4. Audit privileged accounts and administrative activity.
5. Restrict access to management interfaces where possible.
6. Rotate credentials for administrative accounts if compromise is suspected.