CVE catalog

CVE-2026-20262

A vulnerability in the web UI of Cisco Catalyst SD-WAN…

[CVE catalog]

Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.

Severity
Medium · CVSS 6.5
Published
Source
[NVD] · [CVE record]
Exploitation
CISA Known Exploited Vulnerabilities
EPSS
29.12% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence
Original provider fields
{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "catalyst_sd-wan_manager",
      "ecosystem": "cpe",
      "fixed_version": "20.9.9.2"
    },
    {
      "name": "catalyst_sd-wan_manager",
      "ecosystem": "cpe",
      "fixed_version": "20.12.7.2"
    },
    {
      "name": "catalyst_sd-wan_manager",
      "ecosystem": "cpe",
      "fixed_version": "20.15.4.5"
    },
    {
      "name": "catalyst_sd-wan_manager",
      "ecosystem": "cpe",
      "fixed_version": "20.15.5.3"
    },
    {
      "name": "catalyst_sd-wan_manager",
      "ecosystem": "cpe",
      "fixed_version": "20.18.3.1"
    },
    {
      "name": "catalyst_sd-wan_manager",
      "ecosystem": "cpe",
      "fixed_version": "26.1.1.2"
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

Observed:

References

[CERT-Bund public advisories] · [CISA Known Exploited Vulnerabilities (OSINT)] · [FIRST EPSS] · [National Vulnerability Database (NVD)]