CVE-2026-20262: Cisco Catalyst SD-WAN Manager (vManage) Arbitrary File Upload Flaw Exploited as Zero-Day for Root Privilege Escalation
CVE-2026-20262 (TL-2026-0811), also tracked as cisco-sa-sdwan-arbfw-c2rZvQ, is a medium-severity software vulnerability scored CVSS 6.5, first published 2026-06-15. It has no confirmed attribution, affects Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage), references 1 CVE (CVE-2026-20262), maps to 15 MITRE ATT&CK techniques (T1036, T1059, T1068), and is covered by 9 detection rules and 19 indicators of compromise.
Key facts for TL-2026-0811
- Threat ID
- TL-2026-0811
- Also known as
- cisco-sa-sdwan-arbfw-c2rZvQ, CSCwu18441
- Severity
- MEDIUM
- CVSS
- 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-06-15
- Last reviewed
- 2026-06-15
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- telecommunications, government, financial, enterprise, managed-service-providers
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 19
Cisco patched CVE-2026-20262, a path-traversal/arbitrary-file-write vulnerability (CWE-22) in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) caused by insufficient validation of user-supplied input during file uploads. A low-privileged authenticated remote attacker can send crafted HTTP requests to an affected API endpoint to create or overwrite arbitrary files on the underlying OS and chain that into root-level privilege escalation. Cisco PSIRT confirmed limited in-the-wild (zero-day) exploitation in June 2026.
How CVE-2026-20262 works
CVE-2026-20262 is an authenticated arbitrary-file-creation/overwrite vulnerability in Cisco Catalyst SD-WAN Manager (the management plane of the Catalyst SD-WAN fabric, formerly branded SD-WAN vManage). The root cause is insufficient validation of user-supplied input during file-upload operations exposed by an HTTP API endpoint, classified by Cisco as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal). Cisco assigned it a CVSS 3.1 base score of 6.5 (Medium Security Impact Rating) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N — network-reachable, low attack complexity, requiring only low privileges and no user interaction, with high impact to integrity but no direct confidentiality or availability impact at the vulnerability layer.
Exploitation requires valid credentials for at least a lower-privileged, single-task user account. With those credentials, an attacker issues crafted HTTP requests to the vulnerable upload endpoint (handled server-side by the AnyConnect file-upload handler, identified in vManage logs as SdraAnyConnectFileUploadHandler); because the application does not properly constrain the destination pathname, the attacker supplies directory-traversal sequences (for example ../../../../var/lib/wildfly/standalone/deployments/suspicious.war) to write or overwrite files at attacker-chosen locations on the appliance filesystem. By planting a Java WAR archive into the WildFly/JBoss application server's hot-deploy directory (/var/lib/wildfly/standalone/deployments/), the WildFly deployment scanner auto-activates the archive, giving the attacker code execution within the privileged Manager application context. Observed artifacts also include JSP web shells (e.g. index.jsp) reached via POST requests to suspicious JSP endpoints through the service proxy. Because the deployed/overwritten content is executed by privileged processes, the attacker escalates from the low-privileged user to root, gaining full control of the SD-WAN management plane that orchestrates the entire WAN fabric.
The Cisco PSIRT became aware of limited exploitation in June 2026, making this a zero-day at the time of disclosure; Cisco notes the vulnerability was originally found during internal security testing. Cisco published security advisory cisco-sa-sdwan-arbfw-c2rZvQ (Cisco bug ID CSCwu18441) on June 15, 2026, with fixed software for all affected trains. The flaw affects Catalyst SD-WAN Manager across all deployment models (On-Prem, Cloud-Pro/Cisco-hosted, Cloud Managed, and Government/FedRAMP). There are no workarounds — upgrading is the only remediation. Defenders should patch to the fixed releases immediately and hunt for the documented artifacts: SdraAnyConnectFileUploadHandler entries with anomalous .war deployments in /var/log/nms/vmanage-server.log, WildFly deployment-scanner war-activation messages in /var/log/nms/vmanage-appserver.log, and POST requests to suspicious JSP endpoints in /var/log/nms/containers/service-proxy/serviceproxy-access.log. No threat-actor attribution has been published.
MITRE ATT&CK techniques used in TL-2026-0811
Defense Evasion
T1036 Masquerading; T1070 Indicator Removal
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Discovery
T1083 File and Directory Discovery
defense-impairment
T1222 File and Directory Permissions Modification
Persistence
T1505 Server Software Component; T1543 Create or Modify System Process
stealth
Resource Development
Affected products and versions in CVE-2026-20262
- Cisco — Catalyst SD-WAN Manager (formerly SD-WAN vManage)
Vulnerable versions: 20.9.9.1 and earlier; 20.12.7.1 and earlier; 20.15.4.4 and earlier; 20.15.5.2 and earlier; 20.18.3; 26.1.1.1 and earlier
Fixed in: 20.9.9.2; 20.12.7.2; 20.15.4.5; 20.15.5.3; 20.18.3.1; 26.1.1.2
Remediation for CVE-2026-20262
Patches
- Cisco fixed releases per advisory cisco-sa-sdwan-arbfw-c2rZvQ: 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, 26.1.1.2
Immediate actions
- Upgrade Cisco Catalyst SD-WAN Manager to the relevant fixed release: 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, or 26.1.1.2
- Treat internet-exposed or recently-exposed vManage instances as potentially compromised and conduct an integrity review
- Hunt for SdraAnyConnectFileUploadHandler entries with unexpected .war deployments and for index.jsp/.jsp uploads in /var/log/nms/vmanage-server.log, /var/log/nms/vmanage-appserver.log and /var/log/nms/containers/service-proxy/serviceproxy-access.log
- Inspect the WildFly hot-deploy directory /var/lib/wildfly/standalone/deployments/ for unexpected or recently modified .war archives
Workarounds
- Cisco published no workarounds; upgrading to a fixed release is the only remediation. Limit network reachability to the vManage management API as interim risk reduction.
Longer-term hardening
- Restrict management-plane (vManage) access to trusted administrative networks/VPN; never expose the management API to the public internet
- Enforce least privilege on vManage accounts and rotate credentials for low-privileged/single-task users
- Deploy file-integrity monitoring on the WildFly deployments directory and vManage application-server webapps paths
- Centralize and alert on vManage NMS logs in a SIEM for upload-anomaly, path-traversal and webshell detection
CVEs associated with CVE-2026-20262
CVE-2026-20262
Weaknesses (CWE) in CVE-2026-20262
CWE-22
Timeline of CVE-2026-20262
- Cisco notes CVE-2026-20262 was originally found during internal Cisco security testing of Catalyst SD-WAN Manager.
- Cisco PSIRT becomes aware of limited active exploitation of the arbitrary file-write flaw in Catalyst SD-WAN Manager (June 2026).
- Limited in-the-wild exploitation of CVE-2026-20262 begins against internet-reachable Cisco Catalyst SD-WAN Manager instances (zero-day, early June 2026).
- Cisco confirms there are no workarounds for CVE-2026-20262; upgrading to a fixed release is the only remediation.
- BleepingComputer reports Cisco fixing the SD-WAN vManage flaw exploited in zero-day attacks, summarizing the upload-artifact IOC guidance.
- Cisco publishes indicators of compromise: SdraAnyConnectFileUploadHandler with suspicious .war deployments, WildFly deployment-scanner war-activation messages, and POST requests to suspicious JSP endpoints across three NMS log files.
- Cisco releases fixed software: 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, and 26.1.1.2.
- Cisco publishes security advisory cisco-sa-sdwan-arbfw-c2rZvQ v1.0 (bug ID CSCwu18441), CVSS 6.5 Medium, confirming limited exploitation.
- CVE-2026-20262 assigned to the Cisco Catalyst SD-WAN Manager arbitrary file upload / path-traversal vulnerability (CWE-22).
Sources cited for CVE-2026-20262
- Cisco fixes SD-WAN vManage flaw exploited in zero-day attacks
- Cisco Security Advisory: Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability (cisco-sa-sdwan-arbfw-c2rZvQ)
- NVD - CVE-2026-20262
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CISA Known Exploited Vulnerabilities Catalog
- MITRE ATT&CK T1505.003 - Server Software Component: Web Shell
- MITRE ATT&CK T1190 - Exploit Public-Facing Application
Threats related to CVE-2026-20262
- Schneider Electric Floating License Manager - CVE-2024-2658 Local Privilege Escalation via Uncontrolled Search Path in FlexNet Publisher
- LegacyHive Exploitation Chain Bypasses Windows Security Even With July 2026 Patches Installed
- SolarWinds Serv-U 2026.3 Patches 16 Vulnerabilities (CVE-2026-28302 to CVE-2026-28321) Including Root RCE, IDOR-Chained Privilege Escalation, and Broken Access Control
- "LegacyHive" Windows User Profile Service Zero-Day Allows Non-Admin Registry Hive Hijacking
- Cisco Unified CM / Unified CM SME SSRF Vulnerability (CVE-2026-20230) — WebDialer File-Write to Root, Actively Exploited, Added to CISA KEV
- CVE-2026-50656: RoguePlanet Microsoft Defender Zero-Day Local Privilege Escalation (Malware Protection Engine TOCTOU)
Detection coverage for TL-2026-0811
As of 2026-06-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0811 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.