CVE-2026-20262 is a zero-day vulnerability in Cisco Catalyst SD-WAN Manager that permits arbitrary file write via specially crafted HTTP requests to an affected API endpoint. Exploitation requires valid credentials with at least write access. The arbitrary file write can be used to escalate privileges to root on the underlying operating system. Cisco discovered the vulnerability internally and observed limited exploitation in June 2026, suggesting targeted attacks by sophisticated threat actors. Cisco has released patches for this vulnerability. CISA has included CVE-2026-20262 in its Known Exploited Vulnerabilities catalog, instructing federal agencies to remediate it promptly. This vulnerability is part of a series of SD-WAN flaws exploited in 2026.

An attacker with valid credentials and write access can exploit this vulnerability to write arbitrary files on the system hosting Catalyst SD-WAN Manager, potentially leading to root privilege escalation. This could allow full control over the affected system. The vulnerability has been exploited in limited, targeted attacks, indicating active threat exploitation. The impact is critical due to the potential for complete system compromise.

Cisco has released official patches to address CVE-2026-20262. Organizations using Catalyst SD-WAN Manager should apply these patches immediately. CISA mandates remediation by June 29, 2026, for federal agencies. Since exploitation requires valid credentials with write access, organizations should also review and restrict access controls accordingly. Patch status is confirmed as fixed by Cisco's advisory.