Cisco Catalyst SD-WAN Manager: Arbitrary file overwrite in API
Deadline for US federal agencies: 23 Apr 2026
Summary
A flaw in the API of Cisco Catalyst SD-WAN Manager (formerly vManage) allows an authenticated remote attacker to overwrite arbitrary files on the local file system. The attacker needs valid read-only API credentials with API access; by uploading a malicious file, they can gain vmanage user privileges. Cisco and CISA confirm active exploitation, and no workaround exists.
Affected
- Cisco Catalyst SD-WAN Manager, regardless of device configuration, including on-prem and cloud-managed deployments
- Affected releases are listed in the Cisco advisory cisco-sa-sdwan-authbp-qwCX8D4v; the CVE record includes 20.1.x, 19.2.x, 19.3.0, 18.4.x and 18.3.x releases (default: unknown)
Fixed in
- Upgrade to the fixed release for your train, as listed in the Cisco advisory table
- Third-party reports name 20.9.8.2, 20.12.5.3, 20.12.6.1, 20.15.4.2 and 20.18.2.1 as first fixed releases; verify against the Cisco table before the change
- Applicability to 20.18.x is not confirmed
Workaround
Unknown. Cisco states that no workarounds are available. Hardening measures reduce exposure but do not fix the vulnerability.
Exploitation
- Cisco and CISA confirm active exploitation; CISA added the flaw to the KEV catalog on 2026-04-20 with a due date of 2026-04-23
- VulnCheck reports that its researchers used the flaw to upload a webshell; no public proof-of-concept release has been confirmed
- Ransomware use: unknown. Threat actor: not attributed
Our recommendation
- Inventory all SD-WAN Manager instances and their versions, including cloud-managed ones
- Upgrade to a fixed release now and check the Cisco advisory table for your release
- Until patched, restrict management access, disable HTTP and audit read-only API accounts
- Hunt for compromise: check /var/log/nms/containers/service-proxy/serviceproxy-access.log for references to the upload API path and look for unexpected file changes on the manager
- Rotate read-only API credentials and review admin accounts
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Security Advisory cisco-sa-sdwan-authbp-qwCX8D4v sec.cloudapps.cisco.com
- CISA Known Exploited Vulnerabilities Catalog entry CVE-2026-20122 www.cisa.gov
- NVD entry CVE-2026-20122 nvd.nist.gov
- The Hacker News: Cisco confirms active exploitation thehackernews.com
- Help Net Security: CVE-2026-20128 and CVE-2026-20122 exploited www.helpnetsecurity.com
- VulnCheck: Cisco SD-WAN Manager vulnerabilities www.vulncheck.com
- Deepwatch customer advisory CA-A-010 www.deepwatch.com
- Fidelis Security: CVE-2026-20122 fidelissecurity.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:05.
Original description (NVD)
A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system. This vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.
Required action (CISA)
Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.