CVE-2026-20122 | Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability

Exp

A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system. This vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.

Published: 2026-02-25 Last update: 2026-06-17 Assigner: [email protected] Source: [email protected]

NVD Status：Analyzed，CVE State: published

View at NVD, CVE.org, EUVD

Threat Intelligence & Risk Assessment for CVE-2026-20122

KEV EPSS CVSS CWE GHSA Affected

Conclusion & alert: CVE-2026-20122 is rated Critical Active Threat (80.2/100): CVSS Medium severity, with high exploitation likelihood (EPSS 7.02%, 93th percentile). Core evidence: CISA KEV confirms active exploitation (added 2026-04-20) affecting Cisco / Catalyst SD-WAN Manger. a weakness (CWE-648) Unauthenticated remote administrative access may be possible. Mandatory action: The CISA remediation deadline has passed—treat as an emergency patch priority.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

CISA KEV Record for CVE-2026-20122

Name: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability · CISA KEV detail

Exploit added: 2026-04-20

Action due: 2026-04-23

Required action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.

Exploit prediction scoring system (EPSS) score for CVE-2026-20122

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-23	6.13%	7.02%	+0.89%
2	2026-06-15	1.40%	6.13%	+4.73%
3	2026-06-10	—	1.40%	—

Full EPSS history (12 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2026-20122

CVSS metrics for this CVE.

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
5.4	3.1	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:N) Service keeps running; no real outage angle.	2.8	2.5	[email protected]
5.4	3.1	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:N) Service keeps running; no real outage angle.	2.8	2.5	[email protected]

Weakness enumeration for CVE-2026-20122

CWE-648 MITRE ↗

GitHub Security Advisory for CVE-2026-20122

GHSA-9qpv-49q8-9chx · Severity: medium — A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote...

Affected software / configurations for CVE-2026-20122

Vendor	Product	Version	Raw CPE
cisco	catalyst_sd-wan_manager	< 20.9.8.2	cpe:2.3:a:cisco:catalyst_sd-wan_manager::::::::
cisco	catalyst_sd-wan_manager	>= 20.10, < 20.12.5.3	cpe:2.3:a:cisco:catalyst_sd-wan_manager::::::::
cisco	catalyst_sd-wan_manager	>= 20.13, < 20.15.4.2	cpe:2.3:a:cisco:catalyst_sd-wan_manager::::::::
cisco	catalyst_sd-wan_manager	>= 20.16, < 20.18.2.1	cpe:2.3:a:cisco:catalyst_sd-wan_manager::::::::
cisco	catalyst_sd-wan_manager	20.12.6	cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.6:::::::*

References for CVE-2026-20122

URL	Tags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v	Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20122	US Government Resource

cvelogic Threat Intelligence