Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.
CVE-2026-20122 is a medium-severity vulnerability in the Cisco Catalyst SD-WAN Manager API. It matters because it allows a low-privileged, authenticated attacker to overwrite arbitrary files on the system. By exploiting improper file handling in privileged APIs, an attacker can escalate their access to the vmanage user level, potentially compromising the integrity of the SD-WAN management plane.
CVE-2026-20122 is a significant vulnerability affecting Cisco Catalyst SD-WAN Manager involving the Incorrect Use of Privileged APIs (CWE-648). With a CVSS score of 5.4 (Medium), it allows authenticated users with read-only API access to perform arbitrary file overwrites, leading to privilege escalation to the vmanage user. Urgent remediation is required by April 23, 2026, to comply with CISA Emergency Directive 26-03.
| Field | Value |
|---|---|
| CVE ID | CVE-2026-20122 |
| Affected Product | Catalyst SD-WAN Manager |
| Affected Versions | 20.1.12, 19.2.1, 18.4.4, 18.4.5, 20.x, 19.x, 18.x, 17.x (See Full List) |
| CVSS Score & Severity | 5.4 (MEDIUM) |
| CVSS Version | 3.1 |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| Attack Vector | NETWORK |
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| CWE IDs | CWE-648 |
| Date Disclosed | 2026-04-20 |
| Remediation Deadline | 2026-04-23 |
| SSVC Exploitation Status | Active |
| Known Ransomware Use | Unknown |
| Patch Available | Yes |
Cisco Catalyst SD-WAN Manager, formerly known as vManage, serves as the central orchestration point for software-defined wide area networks. Its role in managing configuration, telemetry, and security policies makes it a high-value target for threat actors. CVE-2026-20122 identifies a logic flaw within the management API that permits an authenticated user—even one with minimal "read-only" privileges—to interact with privileged file-handling routines.
This vulnerability is particularly concerning because it bypasses the traditional authorization barriers expected in a multi-tenant or role-based access control (RBAC) environment. While the CVSS score is categorized as Medium, the potential for an attacker to gain vmanage user privileges effectively grants them substantial control over the management plane of the SD-WAN fabric.
At the core of CVE-2026-20122 is CWE-648: Incorrect Use of Privileged APIs. This occurs when a software system provides an API that performs sensitive operations (like filesystem modifications) but fails to enforce the appropriate privilege checks before executing those tasks.
In the case of Catalyst SD-WAN Manager, the API interface allows for file uploads. However, the backend implementation of this API improperly handles the destination path or the context in which the file is written. By sending a specially crafted API request, an attacker can specify a file path that they should not have permission to modify.
vmanage user context.This attack surface is strictly network-based and requires no user interaction, making it highly automatable for attackers who have already established a foothold within the corporate network.
This vulnerability impacts a vast array of Cisco Catalyst SD-WAN Manager versions, spanning several years of releases. Affected branches include:
Compliance Note: Under CISA's Binding Operational Directive (BOD) 22-01 and Emergency Directive 26-03, organizations—particularly those in the federal civilian executive branch—are required to remediate this vulnerability by April 23, 2026. This deadline reflects the critical nature of SD-WAN infrastructure and the potential for active exploitation (SSVC: active).
Cisco has released fixed software versions for all supported release trains. To secure your environment, follow these steps:
show version.Beyond patching, organizations should implement the following defensive measures to harden their SD-WAN management plane:
POST or PUT requests to file-handling endpoints, especially those originating from unexpected source IPs or low-privilege accounts.