DaystoPatch

CiscoExploited incident

Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability

CVE-2026-20262Medium, CVSS 6.5In CISA's Known Exploited Vulnerabilities catalog since 15 Jun 2026

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
0h
First public report to first vendor statement
Exposure
0h
First public report to first fix
Follow-through
0h
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Cisco PSIRT advisory cisco-sa-sdwan-arbfw-c2rZvQCuratedQuote verified

    In June 2026, the Cisco PSIRT became aware of limited exploitation of this vulnerability. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability.

    Disclosed in the advisory first published 2026 June 15 16:00 GMT. The only revision (1.1, same day, 'Last Updated: 2026 June 15 22:00 GMT') changed the Summary and Indicators of Compromise, not the Exploitation section. No earlier public report found.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f4d6d2ea90c5fcba…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    CISA KEV (CVE-2026-20262)ClaimedQuote verified15 Jun 2026

    Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability

    Added to CISA's KEV catalog on 2026-06-15.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-20262ClaimedQuote verified15 Jun 2026, 16:21 UTC

    A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a1459d252d06fcde…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet15 Jun 2026, 17:13 UTC

    Cisco has released security updates to address a vulnerability in the Catalyst SD-WAN Manager, tracked as CVE-2026-20262, that was exploited in attacks to escalate to root privileges.

    Earliest third-party post we hold. An independent author on another platform posted within 48 hours. Used for unreviewed incidents only, never graded.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet15 Jun 2026, 17:39 UTC

    Cisco Patches SD-WAN Flaw Exploited in Zero-Day Attacks Cisco has patched a high-risk SD-WAN flaw, known as CVE-2026-20262, that was being exploited in zero-day attacks to gain root privileges. The vulnerability allowed attackers to create or overwrite files on affected systems, and

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet15 Jun 2026, 21:41 UTC

    Cisco SD-WAN Manager arbitrary file write (CVE-2026-20262) – CISA KEV

    Earliest third-party post we hold. An independent author on another platform posted within 48 hours. Used for unreviewed incidents only, never graded.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Cisco PSIRT advisory cisco-sa-sdwan-arbfw-c2rZvQCuratedQuote verified

    First Published: 2026 June 15 16:00 GMT

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f4d6d2ea90c5fcba…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    at disclosure

    Cisco CSAF for companion advisory cisco-sa-sdwan-privesc-4uxFrdzx, revision 1.5.0CuratedQuote verified

    Updated fixed release table to include additional affected trains and fix availability for Release 26.1.1.2.

    R2: 26.1.1.2, listed as a first fixed release for CVE-2026-20262 in cisco-sa-sdwan-arbfw-c2rZvQ, was announced as available in the CVE-2026-20245 advisory at this time (CSAF revision 1.5.0, 2026-06-10T19:39:26+00:00), five days before the CVE-2026-20262 advisory.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:bd3c3f60f158ff60…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    at disclosure

    Cisco CSAF for companion advisory cisco-sa-sdwan-privesc-4uxFrdzx, revision 1.8.0CuratedQuote verified

    Updated fixed release table with Releases 20.9.9.2 and 20.12.7.2. Changed advisory status from interim to final.

    R2/R6: the last of the builds that cisco-sa-sdwan-arbfw-c2rZvQ lists as first fixed (20.9.9.2, 20.12.7.2) became available at this time; the others (20.15.4.5, 20.15.5.3, 20.18.3.1, 26.1.1.2) were available by then.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:bd3c3f60f158ff60…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Cisco Catalyst SD-WAN Manager
How we built this timeline

CORRECTION PASS 23 Oct 2026 (R2, R4): the fixed builds named in this advisory (20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, 26.1.1.2) are the same builds Cisco shipped on 10 Jun 2026..06-12 for CVE-2026-20245, so First fix/Fixed for all versions now use those availability times (from cisco-sa-sdwan-privesc-4uxFrdzx's CSAF) instead of this advisory's 15 Jun 2026 date. exploited before a fix changed true -> false: the fixed builds were public before the earliest public evidence of exploitation (this advisory, 15 Jun 2026: 'In June 2026, the Cisco PSIRT became aware of limited exploitation'). Exposure is 0.

Requires authenticated access with at least write privileges. Found during internal security testing.

Severity follows the CVSS base score 6.5 (Cisco SIR: Medium).

Related

Cisco report card