CVE-2026-20122

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-20122
A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system. This vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20122 US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.6:*:*:*:*:*:*:*
History

21 Apr 2026, 11:59

Type Values Removed Values Added
References () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20122 - () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20122 - US Government Resource

20 Apr 2026, 20:16

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20122 -
Summary
  • (es) Una vulnerabilidad en la API de Cisco Catalyst SD-WAN Manager podría permitir a un atacante remoto y autenticado sobrescribir archivos arbitrarios en el sistema de archivos local. Para explotar esta vulnerabilidad, el atacante debe tener credenciales válidas de solo lectura con acceso a la API en el sistema afectado. Esta vulnerabilidad se debe a un manejo inadecuado de archivos en la interfaz de la API de un sistema afectado. Un atacante podría explotar esta vulnerabilidad al cargar un archivo malicioso en el sistema de archivos local. Un exploit exitoso podría permitir al atacante sobrescribir archivos arbitrarios en el sistema afectado y obtener privilegios de usuario de vmanage.

04 Mar 2026, 21:25

Type Values Removed Values Added
First Time Cisco
Cisco catalyst Sd-wan Manager
References () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v - () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v - Vendor Advisory
CPE cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.6:*:*:*:*:*:*:*

25 Feb 2026, 17:25

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-25 17:25

Updated : 2026-04-21 11:59

NVD link : CVE-2026-20122

Mitre link : CVE-2026-20122

CVE.ORG link : CVE-2026-20122

JSON object : View

Products Affected

cisco

  • catalyst_sd-wan_manager
CWE
CWE-648

Incorrect Use of Privileged APIs