# CVE-2026-20262: Cisco Catalyst SD-WAN Manager (vManage) Arbitrary File Upload Flaw Exploited as Zero-Day for Root Privilege Escalation

> Cisco patched CVE-2026-20262, a path-traversal/arbitrary-file-write vulnerability (CWE-22) in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) caused by insufficient validation of user-supplied input during file uploads. A low-privileged authenticated remote attacker can send crafted HTTP requests to an affected API endpoint to create or overwrite arbitrary files on the underlying OS and chain that into root-level privilege escalation. Cisco PSIRT confirmed limited in-the-wild (zero-day) exploitation in June 2026.

- **Published:** 2026-06-15T00:00:00Z
- **Last reviewed:** 2026-06-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0811
- **ID:** TL-2026-0811
- **Severity:** MEDIUM (CVSS 6.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20262

## Description

CVE-2026-20262 is an authenticated arbitrary-file-creation/overwrite vulnerability in Cisco Catalyst SD-WAN Manager (the management plane of the Catalyst SD-WAN fabric, formerly branded SD-WAN vManage). The root cause is insufficient validation of user-supplied input during file-upload operations exposed by an HTTP API endpoint, classified by Cisco as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal). Cisco assigned it a CVSS 3.1 base score of 6.5 (Medium Security Impact Rating) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N — network-reachable, low attack complexity, requiring only low privileges and no user interaction, with high impact to integrity but no direct confidentiality or availability impact at the vulnerability layer.

Exploitation requires valid credentials for at least a lower-privileged, single-task user account. With those credentials, an attacker issues crafted HTTP requests to the vulnerable upload endpoint (handled server-side by the AnyConnect file-upload handler, identified in vManage logs as SdraAnyConnectFileUploadHandler); because the application does not properly constrain the destination pathname, the attacker supplies directory-traversal sequences (for example ../../../../var/lib/wildfly/standalone/deployments/suspicious.war) to write or overwrite files at attacker-chosen locations on the appliance filesystem. By planting a Java WAR archive into the WildFly/JBoss application server's hot-deploy directory (/var/lib/wildfly/standalone/deployments/), the WildFly deployment scanner auto-activates the archive, giving the attacker code execution within the privileged Manager application context. Observed artifacts also include JSP web shells (e.g. index.jsp) reached via POST requests to suspicious JSP endpoints through the service proxy. Because the deployed/overwritten content is executed by privileged processes, the attacker escalates from the low-privileged user to root, gaining full control of the SD-WAN management plane that orchestrates the entire WAN fabric.

The Cisco PSIRT became aware of limited exploitation in June 2026, making this a zero-day at the time of disclosure; Cisco notes the vulnerability was originally found during internal security testing. Cisco published security advisory cisco-sa-sdwan-arbfw-c2rZvQ (Cisco bug ID CSCwu18441) on June 15, 2026, with fixed software for all affected trains. The flaw affects Catalyst SD-WAN Manager across all deployment models (On-Prem, Cloud-Pro/Cisco-hosted, Cloud Managed, and Government/FedRAMP). There are no workarounds — upgrading is the only remediation. Defenders should patch to the fixed releases immediately and hunt for the documented artifacts: SdraAnyConnectFileUploadHandler entries with anomalous .war deployments in /var/log/nms/vmanage-server.log, WildFly deployment-scanner war-activation messages in /var/log/nms/vmanage-appserver.log, and POST requests to suspicious JSP endpoints in /var/log/nms/containers/service-proxy/serviceproxy-access.log. No threat-actor attribution has been published.

## MITRE ATT&CK

- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1543 Create or Modify System Process
- T1068 Exploitation for Privilege Escalation
- T1574 Hijack Execution Flow
- T1036 Masquerading
- T1222 File and Directory Permissions Modification
- T1070 Indicator Removal
- T1083 File and Directory Discovery
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol

## Sources

- [Cisco fixes SD-WAN vManage flaw exploited in zero-day attacks](https://www.bleepingcomputer.com/news/security/cisco-fixes-sd-wan-vmanage-flaw-exploited-in-zero-day-attacks/)
- [Cisco Security Advisory: Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability (cisco-sa-sdwan-arbfw-c2rZvQ)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ)
- [NVD - CVE-2026-20262](https://nvd.nist.gov/vuln/detail/CVE-2026-20262)
- [CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')](https://cwe.mitre.org/data/definitions/22.html)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [MITRE ATT&CK T1505.003 - Server Software Component: Web Shell](https://attack.mitre.org/techniques/T1505/003/)
- [MITRE ATT&CK T1190 - Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0811