# Cisco Catalyst SD-WAN Manager Active Exploitation — Arbitrary File Overwrite and Credential Exposure (CVE-2026-20122, CVE-2026-20128)

> Two actively exploited vulnerabilities in Cisco Catalyst SD-WAN Manager (formerly Viptela vManage) are being chained by threat actors to deploy web shells on SD-WAN management appliances globally. CVE-2026-20122 (CVSS 5.4) is an arbitrary file overwrite via the management API exploitable with read-only credentials, while CVE-2026-20128 (CVSS 7.5) exposes Data Collection Agent credentials enabling privilege escalation. Exploitation peaked on March 4, 2026, with CISA issuing Emergency Directive ED 26-03.

- **Published:** 2026-03-06T12:00:00Z
- **Last reviewed:** 2026-03-06T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0185
- **ID:** TL-2026-0185
- **Severity:** CRITICAL (CVSS 7.5)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20122, CVE-2026-20128, CVE-2022-20775, CVE-2026-20127

## Description

Two critical vulnerabilities in Cisco Catalyst SD-WAN Manager are under active exploitation as of early March 2026, part of a broader campaign targeting Cisco SD-WAN infrastructure that has been ongoing since at least 2023.

CVE-2026-20122 (CVSS 5.4, CWE-648) is an arbitrary file overwrite vulnerability in the Cisco Catalyst SD-WAN Manager API. The root cause is twofold: (1) API endpoints validate authentication but fail to enforce write-permission checks, allowing read-only users to execute file write operations, and (2) user-controlled file destination paths lack adequate sanitization, enabling directory traversal attacks. An authenticated remote attacker with only read-only API credentials can overwrite arbitrary files on the local filesystem, gaining vmanage user privileges. The attack surface is the HTTPS management interface on ports 443/8443. This vulnerability is frequently chained with authentication bypass flaws to achieve unauthenticated exploitation.

CVE-2026-20128 (CVSS 7.5, CWE-257) is an information disclosure and privilege escalation vulnerability in the Data Collection Agent (DCA) feature. An unprotected credential file containing the DCA user password is accessible to any user with valid vManage filesystem access. An authenticated local attacker can read this file and use the extracted credentials to gain DCA user privileges, potentially enabling lateral movement across the SD-WAN management infrastructure. Versions 20.18 and later are not affected by this specific CVE.

These vulnerabilities exist alongside CVE-2026-20127 (CVSS 10.0), a critical authentication bypass in the SD-WAN Controller that has been exploited by sophisticated threat actor UAT-8616 since 2023 to establish persistent footholds in high-value organizations. The broader campaign involves software version downgrades, exploitation of CVE-2022-20775 for root escalation, and stealth restoration of original firmware.

watchTowr observed exploitation attempts from numerous unique IP addresses with a peak on March 4, 2026. Threat actors are deploying web shells on exposed SD-WAN Manager instances, overwriting files via the API vulnerability to plant persistent backdoors. Attack activity is globally distributed with slightly elevated targeting of U.S.-based infrastructure.

CISA issued Emergency Directive ED 26-03 on February 26, 2026, requiring federal agencies to inventory systems, collect forensic artifacts, apply patches, and hunt for compromise indicators. The Australian ASD-ACSC, Canadian CCCS, and other Five Eyes partners issued a joint advisory. Cisco patched the vulnerabilities on February 25, 2026, but exploitation intensified after patch release due to rapid weaponization.

The affected product — Cisco Catalyst SD-WAN Manager — is a critical network management plane component used by enterprises, service providers, and government agencies to orchestrate and manage SD-WAN overlay networks. Compromise of vManage provides attackers with visibility into and control over the entire SD-WAN fabric, including routing policies, traffic flows, and connected edge devices.

---

**Revalidated on 2026-03-12**

This threat has been significantly escalated since its initial publication. On March 5, 2026, Cisco PSIRT confirmed active in-the-wild exploitation of both CVE-2026-20122 (arbitrary file overwrite via API, CVSS 7.1) and CVE-2026-20128 (DCA credential exposure enabling cross-instance lateral movement, CVSS 5.5). These vulnerabilities are being exploited as part of a broader, highly sophisticated campaign tracked by Cisco Talos as UAT-8616, which has been targeting Cisco SD-WAN infrastructure globally since at least 2023. The campaign initially leveraged CVE-2026-20127 (CVSS 10.0 authentication bypass) for initial access, then chained CVE-2022-20775 for root privilege escalation via software version downgrade — a technique designed to evade forensic detection by reverting to the original version after exploitation. The exploitation of CVE-2026-20122 and CVE-2026-20128 represents a widening of the attack surface, with attackers using arbitrary file overwrites to gain vmanage user privileges and harvesting DCA credential files to move laterally between SD-WAN Manager deployments. A major exploitation spike was observed on March 4, 2026, with web shell deployment confirmed from numerous unique IP addresses across global regions. The government response has been unprecedented: CISA issued Emergency Directive ED 26-03 on February 25, 2026, mandating federal agencies to inventory, patch, and hunt for compromise, with supplemental hunt and hardening guidance released subsequently. A Five Eyes joint advisory (NSA, CISA, FBI, ASD ACSC, CCCS, NCSC-NZ, NCSC-UK) was published alongside a detailed Cisco SD-WAN Threat Hunt Guide. Additional advisories were issued by the Cyber Security Agency of Singapore and NHS England. CVE-2026-20127 and CVE-2022-20775 were added to the CISA KEV catalog on February 25, 2026 with an emergency 24-hour remediation deadline. Patches are available in versions 20.9.8.2, 20.12.5.3, 20.15.4.2, and 20.18.2.1. No workarounds exist — patching is the only remediation. Organizations on versions older than 20.9 must perform a full migration. Recommended hardening includes configuring DTLS encryption, deploying firewalls in front of SD-WAN infrastructure, using SNMPv3, disabling unnecessary HTTP/FTP services, and changing default administrator passwords.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1098 Account Manipulation
- T1547 Boot or Logon Autostart Execution
- T1136 Create Account
- T1068 Exploitation for Privilege Escalation
- T1070 Indicator Removal
- T1685 Disable or Modify Tools
- T1552 Unsecured Credentials
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1565 Data Manipulation

## Sources

- [Cisco Security Advisory: Catalyst SD-WAN Manager Vulnerabilities (cisco-sa-sdwan-authbp-qwCX8D4v)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v)
- [CISA Emergency Directive ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems](https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems)
- [CISA and Partners Release Guidance for Ongoing Global Exploitation of Cisco SD-WAN Systems](https://www.cisa.gov/news-events/alerts/2026/02/25/cisa-and-partners-release-guidance-ongoing-global-exploitation-cisco-sd-wan-systems)
- [Cisco Talos: Active Exploitation of Cisco Catalyst SD-WAN by UAT-8616](https://blog.talosintelligence.com/uat-8616-sd-wan/)
- [ASD-ACSC Advisory: Exploitation of Cisco SD-WAN Appliances](https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/exploitation-of-cisco-sd-wan-appliances)
- [NVD: CVE-2026-20122](https://nvd.nist.gov/vuln/detail/CVE-2026-20122)
- [NVD: CVE-2026-20128](https://nvd.nist.gov/vuln/detail/CVE-2026-20128)
- [The Hacker News: Cisco Confirms Active Exploitation of Two Catalyst SD-WAN Manager Vulnerabilities](https://thehackernews.com/2026/03/cisco-confirms-active-exploitation-of.html)
- [Help Net Security: Cisco Warns of SD-WAN Manager Exploitation](https://www.helpnetsecurity.com/2026/03/05/cisco-cve-2026-20128-cve-2026-20122-exploited/)
- [SecurityWeek: Cisco Warns of More Catalyst SD-WAN Flaws Exploited in the Wild](https://www.securityweek.com/cisco-warns-of-more-catalyst-sd-wan-flaws-exploited-in-the-wild/)
- [SOCRadar: Cisco Catalyst SD-WAN Manager Flaws Exploited](https://socradar.io/blog/cisco-catalyst-sd-wan-manager-cve-2026-20122/)
- [Security Affairs: Cisco Flags Ongoing Exploitation of Two Recently Patched Catalyst SD-WAN Flaws](https://securityaffairs.com/189056/security/cisco-flags-ongoing-exploitation-of-two-recently-patched-catalyst-sd-wan-flaws.html)
- [RedLegg Security Bulletin: Multiple Vulnerabilities Affecting Cisco SD-WAN Exploited in the Wild](https://www.redlegg.com/blog/security-bulletin-multiple-vulnerabilities-affecting-cisco-sd-wan-exploited-in-the-wild)
- [CIS Advisory: Multiple Vulnerabilities in Cisco Catalyst SD-WAN Products](https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-cisco-catalyst-sd-wan-products-could-allow-for-authentication-bypass_2026-016)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0185