API Vulnerability in Cisco Catalyst SD-WAN Manager Allows File Overwrite
CVE-2026-20122
Key Information:
- Vendor
Cisco
- Vendor
- CVE Published:
- 25 February 2026
Badges
What is CVE-2026-20122?
CVE-2026-20122 is a critical vulnerability found in Cisco's Catalyst SD-WAN Manager, a robust system designed for managing and optimizing Software-Defined Wide Area Networks (SD-WAN). This vulnerability arises from improper file handling in the API of the SD-WAN Manager. It enables authenticated remote attackers, who possess valid read-only credentials, to overwrite arbitrary files on the local file system. This exploit can lead to a significant breach in security, as attackers can gain unauthorized permissions, potentially increasing their control over the system. Given that Cisco Catalyst SD-WAN is widely employed for managing network infrastructure within organizations, the implications of this vulnerability could lead to severe operational disruptions.
Potential impact of CVE-2026-20122
-
Unauthorized Access: The ability for an attacker to overwrite files can result in the elevation of privileges. This means they could gain access to sensitive information or administrative functionalities within the SD-WAN infrastructure.
-
Service Disruption: Exploiting this vulnerability could lead to corrupted or lost configuration files, affecting the operation of critical network functions. Such disruptions can ripple through an organization's operations, resulting in downtime and loss of services.
-
Data Integrity Risks: An attacker could potentially manipulate the configuration or operational files, leading to unauthorized changes in network settings. This could compromise the integrity of the network management system, causing misconfigurations that expose the organization to further vulnerabilities or security breaches.
CISA has reported CVE-2026-20122
CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-20122 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace
The CISA's recommendation is: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Affected Version(s)
Cisco Catalyst SD-WAN Manager 20.1.12
Cisco Catalyst SD-WAN Manager 19.2.1
Cisco Catalyst SD-WAN Manager 18.4.4