Cloud Security

CVE-2026-20262: Cisco’s 8th SD-WAN Zero-Day, Patch Today

June 29, 2026 · 7 min read · By CloudAI Security

Cisco Catalyst SD-WAN Manager (formerly vManage) carries an eighth actively exploited zero-day in 2026 — CVE-2026-20262, a directory/path traversal in the web UI that lets an authenticated remote attacker write arbitrary files and reach root. CISA placed it in the Known Exploited Vulnerabilities (KEV) catalog on June 15 with a remediation deadline of June 29, 2026, meaning the BOD 26-04 clock runs out today.

What CVE-2026-20262 Actually Is

CVE-2026-20262 is a path traversal flaw rooted in insufficient validation of user-supplied input during a file upload operation inside the SD-WAN Manager web UI. Cisco and CISA both describe it as a directory or path traversal (CWE-22): a remote attacker with valid credentials — at minimum a low-privileged single-task user account — can send crafted HTTP requests to an affected API endpoint to create or overwrite any file on the underlying filesystem. Cisco rates it medium severity, but that label undersells the outcome, because the written file can later be loaded or executed to escalate privileges to root.

This is not classic unauthenticated remote code execution. The exploitation prerequisite is a valid account with write access, which changes both the threat model and the detection strategy. The interesting part is how attackers are obtaining those credentials — and that is where 2026’s earlier Cisco SD-WAN disclosures become load-bearing.

The Credential Dependency Chain

The most operationally important paragraph in Cisco’s remediation guidance is the one that connects the dots across the 2026 advisory set. Cisco explicitly states that the known unauthenticated paths to obtain the credentials needed for CVE-2026-20262 are CVE-2026-20182 (cisco-sa-sdwan-rpa2-v69WY2SW) and CVE-2026-20127 (cisco-sa-sdwan-rpa-EHchtZk). In other words, the practical kill chain in the wild is: abuse an unauthenticated remote privilege flaw to mint credentials, then pivot into the file-write bug to plant a root-able payload.

That turns CVE-2026-20262 from an isolated medium-severity item into the final stage of a demonstrated attacker playbook against the SD-WAN control plane. If you patched CVE-2026-20182 and CVE-2026-20127 — and Cisco’s TAC review of your admin-tech bundles found no indicators — the known unauthenticated entry path is mitigated. But Cisco is careful to note that this does not eliminate exposure where an attacker already holds valid credentials through any other route: credential theft, secret sprawl, a compromised operator account, or a downstream service compromise.

Eighth in Seven Months

SecurityWeek reports that CVE-2026-20262 is the eighth Cisco SD-WAN vulnerability exploited in 2026, joining CVE-2026-20182, CVE-2026-20127, CVE-2026-20128, CVE-2026-20122, CVE-2026-20133, CVE-2022-20775, and CVE-2026-20245. The disclosure cadence is itself the story: a centralized management plane that governs thousands of edge devices has now produced eight in-the-wild exploits inside seven months, and the same component (vManage/Manager) keeps reappearing in each chain.

Cisco discovered CVE-2026-20262 during internal security testing, then learned from PSIRT telemetry that it was already being abused earlier in June. That gap — internally found yet already operationalized — is the signature of a determined, likely state-aligned actor that had reverse-engineered the same fault surface Cisco was auditing. SOC Prime and BleepingComputer both note that SD-WAN Manager can administer thousands of devices from a single dashboard across on-prem, Cloud-Pro, Cisco Managed Cloud, and FedRAMP deployment models. Compromise of the management plane therefore produces outsized downstream blast radius: one box, one region, or one tenant can cascade into edge firmware, routing policy, and segmented network access.

The recurring pattern should change how defenders budget attention. A single patch cycle is no longer the unit of work for SD-WAN exposure; the unit is a sustained hardening program that treats the management plane as permanently untrusted.

Detection Before the Deadline Expires

Because the deadline lands today, the immediate priority for anyone who cannot yet confirm patched state is detection and forensics, not just patching. Cisco’s guidance centers on admin-tech collection from every control component — vManage, vSmart, and vBond — submitted to TAC for indicator review. The two log surfaces that matter are distinct per advisory:

CVE-2026-20245 (privilege escalation): inspect /var/log/scripts.log on each control component for file-upload entries. Cisco warns these entries do not distinguish legitimate from malicious use, so TAC manual review is required to avoid false positives.
CVE-2026-20262 (arbitrary file write): inspect /var/log/nms/vmanage-server.log (and the vmanage-appserver and serviceproxy-access logs) for suspicious upload activity. Public reporting points to uploads of index.jsp and .war files as the payload delivery mechanism worth hunting.

For teams that cannot ship admin-tech bundles immediately, the manual verification path is to grep those log surfaces for unexpected writes outside normal operational windows and to inventory any .war or JSP artifacts that do not map to a known deployment. The telltale of successful escalation is a file written by a low-privilege context that is subsequently executed or loaded by a higher-privilege service. If you find one, treat the box as compromised, not merely vulnerable, and rotate every credential with write access to the Manager — including service accounts, automation tokens, and any federated identity that has ever authenticated to the console.

Patch Matrix: BOD 26-04

Fixed releases are available across every affected train, and the upgrade is the only durable fix. The vulnerable-to-fixed mapping, as published by Cisco and reflected in vendor coverage, is:

Vulnerable release	Fixed release
20.9.9.1 and earlier	20.9.9.2
20.12.7.1 and earlier	20.12.7.2
20.15.4.4 and earlier	20.15.4.5
20.15.5.2 and earlier	20.15.5.3
20.18.3	20.18.3.1
26.1.1.1 and earlier	26.1.1.2

CISA’s KEV entry sets the due date at June 29, 2026 and the required action under BOD 26-04 is explicit: apply mitigations per vendor instructions, follow the directive’s Forensics Triage Requirements, and — for federal agencies and any organization that has adopted BOD 26-04 as policy — discontinue use of the product if mitigations are unavailable. The directive also requires stakeholders to evaluate each asset’s internet exposure. SD-WAN Managers that are reachable from the internet, or that sit behind a VPN with weak MFA, carry the highest residual risk after today.

Note the due date is a hard floor, not a target. Agencies that miss it are technically out of compliance as of end-of-day June 29, and private-sector defenders who mirror the KEV cadence should treat anything still unpatched on Monday morning as an accepted-risk decision that belongs in writing.

What Eight Zero-Days Means

The honest read of 2026’s Cisco SD-WAN track record is that the management plane has become a recurring target of choice, and the defenders who fare worst are the ones who keep treating each CVE as a discrete ticket. The compounding risk is credential reuse across the chain: every unauthenticated flaw minted this year potentially seeds the next authenticated escalation, so partial patching leaves live credentials in attacker hands even after the unauthenticated hole closes.

Three posture moves outlast any single CVE and should be in place regardless of today’s deadline. First, scope SD-WAN Manager exposure to the smallest possible audience — no internet reachability, strong phishing-resistant MFA, and privileged access workstations for anyone touching the console. Second, treat the vManage credential store as a secrets-management problem, not a local-account problem, and rotate on a fixed cadence rather than on breach. Third, instrument the two log paths Cisco names so that file-write anomalies trigger before the next zero-day is disclosed, because the eighth will not be the last.