CVE-2026-20122
Published 2026-02-25 · Updated 2026-06-17 · Source psirt@cisco.com
Summary
CVE-2026-20122 is a medium-severity (CVSS 5.4) vulnerability in Cisco Catalyst SD-WAN Manger. CISA added it to the Known Exploited Vulnerabilities catalog on April 20, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by April 23, 2026. CISA does not currently list it as used in ransomware campaigns. Cisco has 102 vulnerabilities in the KEV catalog, 7 of them linked to ransomware.
All 102 known-exploited Cisco vulnerabilities →Description
A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system. This vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CISA Known-Exploited Vulnerability
Product: Cisco — Catalyst SD-WAN Manger
Name: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability
Date added: 2026-04-20 · Due: 2026-04-23
Required action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.