Path traversal in Catalyst SD-WAN Manager (formerly SD-WAN vManage) - CVE-2026-20262
Published: June 16, 2026
Vulnerability identifier: #VU134581
CSH Severity: High
CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N]
CVE-ID: CVE-2026-20262
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote user to create or overwrite arbitrary files on the filesystem.
The vulnerability exists due to path traversal in the web UI file upload process when handling file upload requests to an affected API endpoint. A remote user can send a crafted HTTP request to create or overwrite arbitrary files on the filesystem.
A created or overwritten file could later be used to elevate privileges to root.
Note, the vulnerability is being actively exploited in the wild.
Affected software
Catalyst SD-WAN Manager (formerly SD-WAN vManage)
How to mitigate CVE-2026-20262
Install security update from vendor's website.
Catalyst SD-WAN Manager (formerly SD-WAN vManage) - addressed in versions 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, 26.1.1.2