Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite and Privilege Escalation Vulnerability (CVE-2026-20122)
Executive & SecOps Summary
SECOPS ASSESSMENTCisco Catalyst SD-WAN Manager (formerly vManage) API interface
Authenticated remote attackers with read-only API credentials can overwrite arbitrary files on the local file system and gain vmanage user privileges
Apply official Cisco security patches immediately, restrict API access, and audit API permissions for low-privileged accounts
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUNDStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
An arbitrary file overwrite vulnerability (CVE-2026-20122) exists in the API interface of Cisco Catalyst SD-WAN Manager. The vulnerability stems from improper file handling (CWE-648) on the affected system's API interface.
To exploit this vulnerability, an attacker must possess valid credentials with API access, even with read-only privileges. By uploading a malicious file via the API, the attacker can overwrite arbitrary files on the local file system. A successful exploit allows the attacker to escalate privileges to the vmanage user level, potentially compromising the integrity and availability of the SD-WAN controller.
This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog with an EPSS score of 0.94, indicating an extremely high risk of exploitation.
Official Vendor Advisories & References
A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system. This vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.