Cisco patches exploited SD-WAN vManage zero-day flaw

Cisco has addressed a critical security flaw in its Catalyst SD-WAN Manager, previously known as SD-WAN vManage, which was exploited in attacks to escalate privileges to root. The vulnerability, identified as CVE-2026-20262, affects all deployment models of the software, including on-premises, cloud-managed, and government-specific environments.

The issue arises from inadequate validation of user-provided input during file uploads. Attackers with low-level authentication could exploit this by sending specially crafted HTTP requests to an affected API endpoint, enabling them to create or overwrite files on the underlying operating system. These files could later be leveraged to gain root privileges.

What happened

Cisco’s Product Security Incident Response Team (PSIRT) confirmed that the vulnerability was actively exploited in the wild. The company released patches for multiple software releases, including versions 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, and 26.1.1.2. While Cisco did not disclose details about the attacks, it provided indicators of compromise (IOCs) for administrators to check their logs. Specifically, admins should inspect vmanage-server, vmanage-appserver, and serviceproxy-access logs for unauthorized uploads of index.jsp or .war files.

Why it matters

Catalyst SD-WAN Manager is a central management platform for SD-WAN deployments, allowing administrators to oversee up to 6,000 devices from a single dashboard. A compromise of this system could grant attackers broad control over an organization’s network infrastructure, including the ability to manipulate configurations, intercept traffic, or deploy further malicious payloads. The active exploitation of this flaw underscores the urgency for organizations to apply the patches immediately.

This is not the first time Cisco’s SD-WAN software has been targeted. Earlier this year, the company patched multiple vulnerabilities in the same product line, including CVE-2026-20133 (information disclosure), CVE-2026-20128, and CVE-2026-20122 (both exploited in the wild). In May, Cisco also addressed a maximum-severity authentication bypass flaw (CVE-2026-20182) that allowed attackers to gain admin privileges on unpatched devices. Most recently, in June, another zero-day (CVE-2026-20245) was disclosed, which also enabled root-level access.

What to watch

Cisco’s SD-WAN portfolio has become a frequent target for attackers, likely due to its widespread adoption in enterprise and government networks. Organizations should monitor for further vulnerabilities in this software, particularly those that could lead to privilege escalation or remote code execution. Additionally, security teams should evaluate their detection capabilities, as Cisco noted that many successful attacks go undetected by existing monitoring tools. The company’s reference to a whitepaper highlighting gaps in threat detection—where only 14% of successful attacks trigger alerts—suggests that many environments may need to enhance their logging and alerting mechanisms.