CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Cisco Catalyst SD-WAN Manager web UI authenticated path traversal, arbitrary file write to root RCE; CISA KEV 2026-06-15

cve · CVE-2026-20262

Coverage
1
first 2026-06-16 → last 2026-10-21
Latest activity
2026-06-16
An SD-WAN Manager user with write access can overwrite any file; Cisco confirms limited exploitation
Peak priority
notable
1 notable
Targets
telco
sectors: telco, public-sector
Sources cited
5
4 hosts

Defender insights

What each entry about CVE-2026-20262 tells a defender to do, newest first.

2026-06-16NOTABLEexploitedAn SD-WAN Manager user with write access can overwrite any file; Cisco confirms limited exploitation

Exposure · detection

Story timeline

  1. 2026-06-16CVE-2026-20262: Cisco Catalyst SD-WAN Manager authenticated arbitrary file write, exploited and KEV-listed; Cisco says a written file could later be used to gain root
    trending-vulnerabilitiesAn SD-WAN Manager user with write access can overwrite any file; Cisco confirms limited exploitation

Hunting pivots

Affected products
Cisco Catalyst SD-WAN Manager
Tags
actively-exploitedcisa-kevpath-traversalrcevulnerabilities
ATT&CK techniques (3 across 3 tactics)

3 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • PersistenceServer Software Component: Web Shell
  • Privilege EscalationExploitation for Privilege Escalation

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-06-16/cisco-catalyst-sd-wan-manager-cve-2026-20262-authenticated-a · ATT&CK page ↗

Persistence TA0003

T1505.003Server Software Component: Web Shell×1

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.

Evidence: 2026-06-16/cisco-catalyst-sd-wan-manager-cve-2026-20262-authenticated-a · ATT&CK page ↗

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-06-16/cisco-catalyst-sd-wan-manager-cve-2026-20262-authenticated-a · ATT&CK page ↗

Entries about Cisco Catalyst SD-WAN Manager web UI authenticated path traversal, arbitrary file write to root RCE; CISA KEV 2026-06-15 (1)

2026-06-16 · view entry permalink →

NOTABLECVE-2026-20262exploitedupdatedNATOA1

CVE-2026-20262: Cisco Catalyst SD-WAN Manager authenticated arbitrary file write, exploited and KEV-listed; Cisco says a written file could later be used to gain root

CVE-2026-20262 (CVSS 6.5) is an arbitrary file write in the web UI of Cisco Catalyst SD-WAN Manager: the software does not properly validate user-supplied input during a file upload, so an authenticated attacker with at least write access can create or overwrite any file on the system, which Cisco says can later be used to gain root; it affects all deployment types and has no workaround (Cisco PSIRT). Cisco found it in internal testing and became aware of limited exploitation in June 2026 (Cisco PSIRT); CISA added it to its Known Exploited Vulnerabilities catalog on 2026-06-15 as a path traversal (CWE-22) (CISA KEV catalog, 2026-06-15). BleepingComputer reports that Cisco shared no details of the attacks (BleepingComputer, 2026-06-15). First fixed releases are 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1 and 26.1.1.2 (Cisco PSIRT), the same first fixed releases Cisco lists for CVE-2026-20245, the netadmin-to-root command injection it disclosed on 2026-06-04 (Cisco PSIRT, CVE-2026-20245 advisory).

In June 2026, the Cisco PSIRT became aware of limited exploitation of this vulnerability.

Cisco PSIRT 2026-06-15
Correctionrun 2026-10-11T1307Z-audittitleheadlinesummarysourcing_noteentitiestechniquesaffected_productscvessourcesevidenceclassificationdeep_divedeep_dive_categorybody

Cisco's indicators place the planted web application in the application server's deployments directory and record it as a .war deployment (Cisco PSIRT); the earlier text named Tomcat. No cited source attributes exploitation of CVE-2026-20262 to UAT-8616, and Cisco shared no details of the attacks (BleepingComputer, 2026-06-15).

Improvementrun 2026-10-21T1149Z-auditsourcesreferencesbody

Cisco's indicators name the exact log entries: in /var/log/nms/vmanage-server.log, a SdraAnyConnectFileUploadHandler upload whose path climbs into the WildFly deployments directory /var/lib/wildfly/standalone/deployments/ with a .war archive, followed, though not always, by a WFLYSRV0010 deployment line in vmanage-appserver.log and POST requests to the new application's JSP page in the service-proxy access log; Cisco also says Managers with ports exposed to the internet are at risk (Cisco PSIRT). CISA lists the flaw as a path traversal (CWE-22) (CISA KEV catalog, 2026-06-15). Its first fixed releases are the same as for CVE-2026-20245, disclosed on 2026-06-04 (Cisco PSIRT, CVE-2026-20245 advisory).

Builds on: A netadmin user on Cisco SD-WAN can become root through a crafted upload file; Mandiant saw…

vulnerability16 Jun 05:09Zmulti-sourceOpen finding →
Sources: Cisco PSIRT · BleepingComputer · The Register · CISA KEV catalog

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • sec.cloudapps.cisco.com2 (40%)
  • bleepingcomputer.com1 (20%)
  • cisa.gov1 (20%)
  • theregister.com1 (20%)

External references

NVD · cve.org · CISA KEV

All cited sources (5)