Vulnerability in Cisco catalyst-sd-wan-manger (CVE-2026-20122, KEV)

Summary

vulnerability in Cisco catalyst-sd-wan-manger (CVE-2026-20122). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.

Original description

The description as published by the source.

Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.

Source: CISA Known Exploited Vulnerabilities NVD CISA KEV

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

A flaw in Cisco Catalyst SD-WAN Manager due to incorrect use of privileged APIs has been discovered, potentially allowing attackers to upload malicious files and gain user privileges by overwriting critical system files. This poses a significant security risk to the overall system integrity. It is strongly advised to apply the latest security updates to protect your systems.

The vulnerability in Cisco Catalyst SD-WAN Manager arises from the incorrect use of privileged APIs which allows attackers to upload malicious files onto the system's local filesystem, enabling arbitrary file overwriting and privilege escalation to vmanage user privileges. The primary attack vector involves improper file handling on the API interface. The CVSS vector indicates remote exploitability without the need for authentication or user interaction. Immediate application of vendor patches is advised for affected versions.

❓ What is the problem

Cisco Catalyst SD-WAN Managerにおける特権APIの誤用に起因する脆弱性

📍 Affected scope

APIインターフェースの不適切なファイル処理

🔥 Severity

リモートでの攻撃が可能であり、認証も不要

🔧 How to fix

ベンダーパッチを適用する

🛡️ Workaround

特定できず

🔍 Detection

特定できず

Related past incidents Similar incidents extracted from past CVEs

CVE-2022-20648

Cisco SD-WAN Software権限昇格の脆弱性に類似しています

If this happens at your company Expected impact per business scenario

📌 大規模企業のネットワークインフラストラクチャを支えるシステム

攻撃者は重要なシステムファイルを上書きすることでネットワークダウンやサービス停止を引き起こし得る

📌 クラウドサービスプロバイダが管理するSD-WAN環境

顧客データの漏洩や操作の妨害が発生し、評判被害や法的問題に繋がる

📌 多くの支社を持つ企業のWAN環境

全社的なネットワーク障害が発生するリスク

Recommended action

すべての影響を受けるシステムに対してベンダーの最新パッチを適用する

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'catalyst-sd-wan-manger' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で catalyst-sd-wan-manger を grep し、稼働しているサービス・バージョンを把握する。
4
Consider incident declaration escalate
```
Notify SOC / on-call
```
CISA KEV登録済 = 実環境で悪用が観測されている。Step 3 で兆候があればインシデント対応宣言、無くてもパッチ適用までWAF強化を最優先で。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

References

advisory NVD
CISCO sec.cloudapps.cisco.com