CVE-2026-20122

nvd.nist.gov • April 21, 2026

This CVE record has been updated after NVD enrichment efforts were completed. Enrichment data supplied by the NVD may require amendment due to these changes.

A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system. This vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Cisco Catalyst SD-WAN Manager Exploited Two critical vulnerabilities, CVE-2026-20122 and CVE-2026-20128, have been identified in Cisco Catalyst SD-WAN Manager, both published on 2026-02-25. CVE-2026-20122 allows authenticated remote attackers to overwrite arbitrary files via the API, while CVE-2026-20128 permits unauthenticated remote attackers to gain DCA user privileges through a credential file exploit. Both vulnerabilities were added to the CISA KEV list on 2026-04-20 due to active exploitation. Affected systems include versions prior to 20.18 of Cisco Catalyst SD-WAN Manager. Attackers can exploit these vulnerabilities to escalate privileges and potentially compromise additional systems. Organizations using vulnerable versions are urged to apply updates immediately to mitigate these risks. 2 sources 73

Extracted Entities

CVE-2026-20122

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)