[KEV] CVE-2026-20262 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2026-20262 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2026-20262 is a path traversal vulnerability in Cisco Catalyst SD-WAN Manager that allows an authenticated remote attacker to create or overwrite arbitrary files on the underlying filesystem of an affected device.

Technical Detail

The flaw exists in Cisco Catalyst SD-WAN Manager's handling of file paths, where insufficient input validation allows an authenticated attacker to supply traversal sequences that escape the intended directory context. By sending crafted requests, the attacker can write to or overwrite arbitrary files on the system filesystem, which could be leveraged to achieve remote code execution, corrupt critical system files, or establish persistence by planting malicious content in executable paths. The requirement for prior authentication limits the initial attack surface, but any valid account, including low-privileged ones, may be sufficient to trigger the vulnerability depending on the specific code path involved.

Exploitation Status

CISA has confirmed active exploitation in the wild, having added this vulnerability to the Known Exploited Vulnerabilities catalog on June 15, 2026. The exploit maturity is rated Operational, meaning functional exploit code capable of reliable, real-world use exists and is being actively employed against targets, not merely demonstrated in a controlled research setting.

Who Is Targeting This

No specific threat actor attribution has been confirmed or reported at this time. Given the active exploitation status and the high-value nature of SD-WAN management infrastructure as a target, organizations should treat this as a broad opportunistic or targeted threat until attribution is established.

What To Do

CISA's Known Exploited Vulnerabilities catalog listing requires federal agencies to patch or apply mitigations by the deadline associated with the June 15, 2026 addition; all organizations should treat this with equivalent urgency. Apply the relevant Cisco security advisory patch for Catalyst SD-WAN Manager immediately and prioritize systems exposed to the internet or accessible from untrusted network segments. If patching cannot be completed immediately, restrict access to the SD-WAN Manager interface to trusted administrative networks only and enforce multi-factor authentication on all accounts with access to the platform. Review filesystem integrity on affected systems for unexpected file creation or modification events, particularly in directories containing executables, configuration files, or scheduled task definitions, as indicators of prior compromise. Monitor Cisco's advisory channel for updated guidance and specific fixed software versions.