- Medium 5.4
- Known exploited (CISA KEV)
CVE-2026-20122
A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system. This vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage…
Scores
The facts
- Published
- 25 February 2026
- Last changed
- 17 June 2026
- NVD status
- Analyzed
- Severity
- Medium, CVSS 5.4 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- Affects
- cisco catalyst sd-wan manager
- Known exploited
- Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 20 April 2026.
- EPSS
- 25.5% chance of exploitation activity in the next 30 days (percentile 98).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.