CVE-2026-20122 Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs

Exploited in the wild Medium 5.4 Published 25 Feb 2026 Updated 21 Apr 2026

Authenticated attackers can overwrite arbitrary files via the API to gain vmanage user privileges on Cisco Catalyst SD-WAN Manager.

Exploited in the wild: Since 20 Apr 2026
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-20122?

CVE-2026-20122 is a medium-severity vulnerability in Cisco Catalyst Sd-Wan Manager, published on 25 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system. This vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.

Weakness: CWE-648

Which versions are affected by CVE-2026-20122?

It affects 1 product.

Products include Cisco Catalyst Sd-Wan Manager.

How do I fix CVE-2026-20122?

No fix has been published for CVE-2026-20122 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 23 Apr 2026.

Is CVE-2026-20122 being exploited?

Yes. Attackers have exploited CVE-2026-20122 in the wild since at least 20 Apr 2026.

All Cisco Catalyst Sd-Wan Manager vulnerabilities

Sources

Also known as GHSA-9qpv-49q8-9chx.