CVE-2026-20122: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability
A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system. This vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.
Other sources
Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Cisco Catalyst SD-WAN Managerfrom your environment.Discontinue use of the product if mitigations are not available, per the advisory.
- Compensating control
Adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 and CISA’s “Hunt & Hardening Guidance for Cisco SD‑WAN Devices.”
- Operational
Assess exposure of deployed Cisco Catalyst SD‑WAN Manager instances and mitigate risks per CISA Emergency Directive 26-03 and the Hunt & Hardening Guidance; follow applicable BOD 22-01 guidance for cloud services.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20122?
The severity of CVE-2026-20122 is medium, as it allows authenticated attackers to overwrite arbitrary files.
How do I fix CVE-2026-20122?
To fix CVE-2026-20122, ensure that you upgrade to the latest version of Cisco Catalyst SD-WAN Manager that addresses this vulnerability.
What are the consequences of exploiting CVE-2026-20122?
Exploiting CVE-2026-20122 could lead to the manipulation or corruption of files on the affected system, potentially causing data loss or system instability.
Who is affected by CVE-2026-20122?
Organizations using Cisco Catalyst SD-WAN Manager are affected by CVE-2026-20122, particularly those with weak authentication controls.
What type of attacks does CVE-2026-20122 enable?
CVE-2026-20122 enables authenticated remote attackers to execute arbitrary file overwrite attacks on vulnerable systems.