CVE-2026-20122

CVE Enrichment

CVSS: 5.4 MEDIUM
EPSS: 25.80%
EPSS Percentile: 97.98%
CISA KEV: YES — Known Exploited Vulnerability

Description

A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system. This vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 26-Feb-2026 00:25
Last Modified: 17-Jun-2026 17:17
EPSS Date: 2026-11-01
CWE: CWE-648

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:L /
                            I:L /
                            A:N

CISA KEV Details

Date Added: 2026-04-20
Remediation Due: 2026-04-23
Known Ransomware Campaign Use: Unknown
Required Action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Notes: CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v ; https://nvd.nist.gov/vuln/detail/CVE-2026-20122

Affected Products / Versions

cisco / catalyst_sd-wan_manager Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 20.9.8.2
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cisco / catalyst_sd-wan_manager Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 20.10 · before (exclusive) 20.12.5.3
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cisco / catalyst_sd-wan_manager Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 20.13 · before (exclusive) 20.15.4.2
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cisco / catalyst_sd-wan_manager Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 20.16 · before (exclusive) 20.18.2.1
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cisco / catalyst_sd-wan_manager Source: NVD CPE · affected
Version / affected range: 20.12.6
cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.6:*:*:*:*:*:*:*

References

Last enrichment sync: 02-Nov-2026 20:07
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (6)

[CVE IDs] Additional actively exploited network-facing flaws observed by Proofpoint – CVE-2026-20122, CVE-2026-20128, and 2 more CVEs Proofpoint Observes 12 2026 CVEs in Exploitation, Four Not on CISA KEV
The company previously disclosed and released patches for the vulnerabilities — including CVE-2026-20122, CVE-2026-20128 and CVE-2026-20133 — in February. Cisco Warns of Ongoing Exploitation of SD-WAN Zero-Day CVE-2026-20182
company also observing multiple threat clusters exploiting CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122 beginning March 2026. CISA Adds Cisco SD-WAN Authentication Bypass to KEV After Active Exploitation
One week later, the company revealed that two other security flaws it had patched the same day (CVE-2026-20128 and CVE-2026-20122)were being exploited in the wild. CISA Flags Cisco SD-WAN Flaw as Actively Exploited, Orders Agencies to Patch
CVE-2026-20122, CVE-2026-20128, and CVE-2026-20133: Three distinct vulnerabilities impacting Cisco Catalyst SD-WAN Manager, ranging from privilege escalation to exposure of sensitive information. CISA Adds Eight Actively Exploited Vulnerabilities to KEV Catalog

CVE (16)

Malware (8)

People (2)

Threat Actors (8)

MITRE ATT&CK (16)

Vendors (11)

Products (17)

Tools (4)

Industries (4)

Countries (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.