Loading story…
Cisco released fixes for CVE-2026-20262, an actively exploited vulnerability in Cisco Catalyst SD-WAN Manager (vManage) that allows an authenticated remote attacker with low privileges to upload or overwrite files through crafted HTTP requests and ultimately execute commands as root. The flaw stems from insufficient validation of user-supplied input during file uploads in the web UI and affects all deployment models, including on-premises, Cloud-Pro, Cisco-managed cloud, and FedRAMP environments.
Cisco said it became aware of in-the-wild exploitation in June and urged customers to patch immediately, warning that the product’s central role in orchestrating SD-WAN fabrics raises the operational impact of compromise. The company published indicators of compromise tied to uploaded .jsp and .war files, including filenames such as index.jsp and suspicious.war, and advised defenders to inspect vmanage-server, vmanage-appserver, and serviceproxy-access logs, reduce internet exposure, audit accounts, and contact TAC with an admin-tech file if intrusion is suspected.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued alert AV26-602 regarding CVE-2026-20262 in Cisco Catalyst SD-WAN Manager. The alert encouraged users and administrators to review the linked advisories and apply updates when available.
After adding CVE-2026-20262 to the KEV catalog, CISA directed U.S. federal civilian agencies to remediate the Cisco Catalyst SD-WAN Manager flaw by June 29, 2026.
CISA added Cisco Catalyst SD-WAN Manager flaw CVE-2026-20262 to its Known Exploited Vulnerabilities catalog after reports of in-the-wild exploitation. The agency ordered federal civilian agencies to remediate the vulnerability within two weeks.
Cisco released security updates for CVE-2026-20262 and warned customers to patch affected Cisco Catalyst SD-WAN Manager systems immediately. The company also published indicators of compromise, including suspicious uploaded files and related log artifacts defenders should review.
Cisco said its PSIRT became aware earlier in June 2026 that CVE-2026-20262, an arbitrary file write flaw in Cisco Catalyst SD-WAN Manager, was being exploited in the wild. The vulnerability can let an authenticated low-privileged attacker upload or overwrite files and potentially escalate privileges to root.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
18 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourcesocprime.com
Open sourcesec.cloudapps.cisco.com
Open sourcecisa.gov
Open sourcebleepingcomputer.com
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco released security updates to address **CVE-2026-20245**, an authenticated local privilege escalation vulnerability in **Cisco Catalyst SD-WAN Manager**. The flaw stems from insufficient validation of user-supplied input during file upload, allowing a low-privileged local attacker to upload a crafted file, execute arbitrary commands, and escalate privileges to **root** on affected systems. The vulnerability carries a **CVSS score of 7.8** and requires low privileges, low attack complexity, and no user interaction. Security notices published in June urged organizations using affected SD-WAN Manager deployments to test and deploy Cisco's fixes as soon as possible to reduce the risk of post-authentication compromise of network management infrastructure.
Jul 8, 2026
Cisco disclosed active exploitation of **CVE-2026-20245**, a high-severity command injection flaw in **Cisco Catalyst SD-WAN Manager** that lets an authenticated attacker with `netadmin` privileges upload a crafted file and execute arbitrary commands as **root**. The vulnerability affects all deployment models, including on-premises, **Cisco SD-WAN Cloud**, Cloud-Pro, and FedRAMP environments, and Cisco said attackers have already used it in limited incidents to push unauthorized configuration changes to SD-WAN edge devices. Cisco said the flaw stems from insufficient validation and sanitization of user-supplied input in the CLI processing path, and warned that attackers may obtain the required privileges with valid credentials or by chaining previously disclosed bugs such as **CVE-2026-20182** or **CVE-2026-20127**. No dedicated patch or workaround was available at disclosure, so Cisco urged customers to upgrade to software versions that fix earlier exploited issues, review indicators of compromise such as suspicious entries in `/var/log/scripts.log`, preserve forensic evidence, collect diagnostics with the command: ```bash request admin-tech ``` and contact Cisco TAC if compromise is suspected.
Jun 29, 2026
Attackers have actively exploited multiple vulnerabilities in **Cisco Catalyst SD-WAN Manager** (`vManage`) to bypass authentication, escalate privileges to **root**, and alter downstream network infrastructure. Reporting on the campaign says the intrusion chain used critical auth-bypass flaws `CVE-2026-20127` and `CVE-2026-20182` for initial access, then leveraged `CVE-2026-20245` to execute commands as root through crafted file upload and command injection in the CLI. Cisco confirmed limited incidents in which exploitation led to configuration changes being pushed to edge devices, raising the risk that compromise of a single controller could affect broad SD-WAN environments. Cisco also disclosed active exploitation of `CVE-2026-20262`, a separate zero-day in Cisco Catalyst SD-WAN Manager that lets an authenticated low-privilege attacker abuse file-upload handling to create or overwrite files on the underlying operating system and gain root privileges. The flaw affects on-premises, Cloud, Cloud-Pro, and FedRAMP deployments, and Cisco released fixes in versions `20.9.9.2`, `20.12.7.2`, `20.15.4.5`, `20.15.5.3`, `20.18.3.1`, and `26.1.1.2`. U.S. authorities added exploited Cisco SD-WAN flaws to the **Known Exploited Vulnerabilities** catalog, and CISA issued **Emergency Directive 26-03** directing federal agencies to hunt for compromise and rapidly harden affected systems.
Jul 7, 2026