CVE-2026-20262: Cisco Catalyst SD-WAN Manager (vManage) Arbitrary File Upload Flaw Exploited as Zero-Day for Root Privilege Escalation

CVE-2026-20262 (TL-2026-0811), also tracked as cisco-sa-sdwan-arbfw-c2rZvQ, is a medium-severity software vulnerability scored CVSS 6.5, first published 2026-06-15. It has no confirmed attribution, affects Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage), references 1 CVE (CVE-2026-20262), maps to 15 MITRE ATT&CK techniques (T1036, T1059, T1068), and is covered by 9 detection rules and 19 indicators of compromise.

Key facts for TL-2026-0811

Threat ID
TL-2026-0811
Also known as
cisco-sa-sdwan-arbfw-c2rZvQ, CSCwu18441
Severity
MEDIUM
CVSS
6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-06-15
Last reviewed
2026-06-15
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
telecommunications, government, financial, enterprise, managed-service-providers
Target regions
Global
Detection rules
9
Indicators of compromise
19

Cisco patched CVE-2026-20262, a path-traversal/arbitrary-file-write vulnerability (CWE-22) in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) caused by insufficient validation of user-supplied input during file uploads. A low-privileged authenticated remote attacker can send crafted HTTP requests to an affected API endpoint to create or overwrite arbitrary files on the underlying OS and chain that into root-level privilege escalation. Cisco PSIRT confirmed limited in-the-wild (zero-day) exploitation in June 2026.

How CVE-2026-20262 works

CVE-2026-20262 is an authenticated arbitrary-file-creation/overwrite vulnerability in Cisco Catalyst SD-WAN Manager (the management plane of the Catalyst SD-WAN fabric, formerly branded SD-WAN vManage). The root cause is insufficient validation of user-supplied input during file-upload operations exposed by an HTTP API endpoint, classified by Cisco as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal). Cisco assigned it a CVSS 3.1 base score of 6.5 (Medium Security Impact Rating) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N — network-reachable, low attack complexity, requiring only low privileges and no user interaction, with high impact to integrity but no direct confidentiality or availability impact at the vulnerability layer.

Exploitation requires valid credentials for at least a lower-privileged, single-task user account. With those credentials, an attacker issues crafted HTTP requests to the vulnerable upload endpoint (handled server-side by the AnyConnect file-upload handler, identified in vManage logs as SdraAnyConnectFileUploadHandler); because the application does not properly constrain the destination pathname, the attacker supplies directory-traversal sequences (for example ../../../../var/lib/wildfly/standalone/deployments/suspicious.war) to write or overwrite files at attacker-chosen locations on the appliance filesystem. By planting a Java WAR archive into the WildFly/JBoss application server's hot-deploy directory (/var/lib/wildfly/standalone/deployments/), the WildFly deployment scanner auto-activates the archive, giving the attacker code execution within the privileged Manager application context. Observed artifacts also include JSP web shells (e.g. index.jsp) reached via POST requests to suspicious JSP endpoints through the service proxy. Because the deployed/overwritten content is executed by privileged processes, the attacker escalates from the low-privileged user to root, gaining full control of the SD-WAN management plane that orchestrates the entire WAN fabric.

The Cisco PSIRT became aware of limited exploitation in June 2026, making this a zero-day at the time of disclosure; Cisco notes the vulnerability was originally found during internal security testing. Cisco published security advisory cisco-sa-sdwan-arbfw-c2rZvQ (Cisco bug ID CSCwu18441) on June 15, 2026, with fixed software for all affected trains. The flaw affects Catalyst SD-WAN Manager across all deployment models (On-Prem, Cloud-Pro/Cisco-hosted, Cloud Managed, and Government/FedRAMP). There are no workarounds — upgrading is the only remediation. Defenders should patch to the fixed releases immediately and hunt for the documented artifacts: SdraAnyConnectFileUploadHandler entries with anomalous .war deployments in /var/log/nms/vmanage-server.log, WildFly deployment-scanner war-activation messages in /var/log/nms/vmanage-appserver.log, and POST requests to suspicious JSP endpoints in /var/log/nms/containers/service-proxy/serviceproxy-access.log. No threat-actor attribution has been published.

MITRE ATT&CK techniques used in TL-2026-0811

Defense Evasion

T1036 Masquerading; T1070 Indicator Removal

Execution

T1059 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Discovery

T1083 File and Directory Discovery

defense-impairment

T1222 File and Directory Permissions Modification

Persistence

T1505 Server Software Component; T1543 Create or Modify System Process

stealth

T1574 Hijack Execution Flow

Resource Development

T1588 Obtain Capabilities

Affected products and versions in CVE-2026-20262

  • Cisco — Catalyst SD-WAN Manager (formerly SD-WAN vManage)
    Vulnerable versions: 20.9.9.1 and earlier; 20.12.7.1 and earlier; 20.15.4.4 and earlier; 20.15.5.2 and earlier; 20.18.3; 26.1.1.1 and earlier
    Fixed in: 20.9.9.2; 20.12.7.2; 20.15.4.5; 20.15.5.3; 20.18.3.1; 26.1.1.2

Remediation for CVE-2026-20262

Patches

  • Cisco fixed releases per advisory cisco-sa-sdwan-arbfw-c2rZvQ: 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, 26.1.1.2

Immediate actions

  • Upgrade Cisco Catalyst SD-WAN Manager to the relevant fixed release: 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, or 26.1.1.2
  • Treat internet-exposed or recently-exposed vManage instances as potentially compromised and conduct an integrity review
  • Hunt for SdraAnyConnectFileUploadHandler entries with unexpected .war deployments and for index.jsp/.jsp uploads in /var/log/nms/vmanage-server.log, /var/log/nms/vmanage-appserver.log and /var/log/nms/containers/service-proxy/serviceproxy-access.log
  • Inspect the WildFly hot-deploy directory /var/lib/wildfly/standalone/deployments/ for unexpected or recently modified .war archives

Workarounds

  • Cisco published no workarounds; upgrading to a fixed release is the only remediation. Limit network reachability to the vManage management API as interim risk reduction.

Longer-term hardening

  • Restrict management-plane (vManage) access to trusted administrative networks/VPN; never expose the management API to the public internet
  • Enforce least privilege on vManage accounts and rotate credentials for low-privileged/single-task users
  • Deploy file-integrity monitoring on the WildFly deployments directory and vManage application-server webapps paths
  • Centralize and alert on vManage NMS logs in a SIEM for upload-anomaly, path-traversal and webshell detection

CVEs associated with CVE-2026-20262

CVE-2026-20262

Weaknesses (CWE) in CVE-2026-20262

CWE-22

Timeline of CVE-2026-20262

  • Cisco notes CVE-2026-20262 was originally found during internal Cisco security testing of Catalyst SD-WAN Manager.
  • Cisco PSIRT becomes aware of limited active exploitation of the arbitrary file-write flaw in Catalyst SD-WAN Manager (June 2026).
  • Limited in-the-wild exploitation of CVE-2026-20262 begins against internet-reachable Cisco Catalyst SD-WAN Manager instances (zero-day, early June 2026).
  • Cisco confirms there are no workarounds for CVE-2026-20262; upgrading to a fixed release is the only remediation.
  • BleepingComputer reports Cisco fixing the SD-WAN vManage flaw exploited in zero-day attacks, summarizing the upload-artifact IOC guidance.
  • Cisco publishes indicators of compromise: SdraAnyConnectFileUploadHandler with suspicious .war deployments, WildFly deployment-scanner war-activation messages, and POST requests to suspicious JSP endpoints across three NMS log files.
  • Cisco releases fixed software: 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, and 26.1.1.2.
  • Cisco publishes security advisory cisco-sa-sdwan-arbfw-c2rZvQ v1.0 (bug ID CSCwu18441), CVSS 6.5 Medium, confirming limited exploitation.
  • CVE-2026-20262 assigned to the Cisco Catalyst SD-WAN Manager arbitrary file upload / path-traversal vulnerability (CWE-22).

Sources cited for CVE-2026-20262

Threats related to CVE-2026-20262

Detection coverage for TL-2026-0811

As of 2026-06-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0811 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats