In June 2026 CISA listed two Cisco Catalyst SD-WAN Manager flaws a week apart. CVE-2026-20245, a privilege escalation, went on the Known Exploited Vulnerabilities catalog on 9 June. CVE-2026-20262, a path traversal, followed on 15 June with a federal deadline of 29 June.
Cisco's statement, as quoted by Help Net Security: "The fix for both CVE-2026-20262 and CVE-2026-20245 is the same." The gap between listings reflects when Cisco learned of exploitation of each.
What's affected
Cisco Catalyst SD-WAN Manager, in every deployment type: on-premises, Cloud-Pro, Cloud (Cisco managed) and the FedRAMP government offering. Cisco released fixed versions for CVE-2026-20245 by 12 June and for CVE-2026-20262 on 15 June, and the fixed list is identical. I could not retrieve the version numbers from a source I was able to read, so take them from Cisco's advisory for your release train.
- CVE-2026-20245: privilege escalation from insufficient validation of user input.
- CVE-2026-20262: path traversal (CWE-22) in the web UI. A crafted request to an API endpoint can create or overwrite any file on the underlying operating system, which could later be used to gain root. It needs valid credentials with at least write access. Cisco says its own internal testing found the flaw.
Cisco's investigators saw attackers drop a malicious .war file that the WildFly application server deployed as a web application, then send commands to it using POST requests.
How to check if you're exposed
Check the running release from the CLI and compare it against Cisco's fixed list:
show version
Then follow Cisco's advisory to search logs for the listed indicators of compromise. Cisco warns that some indicators may be missing from a given incident's logs, so absence is not proof of safety. Review which accounts have write access, and whether the Manager's web interface and ports are reachable from outside the management network.
What to do now
- Upgrade to a fixed release. One upgrade covers both CVEs.
- Search for the indicators from the advisory, with extra attention to unexpected
.warfiles and new web applications on the Manager. - Audit accounts with write access or higher, and remove ones nobody can justify.
- Block internet access to the Manager's web interface and ports.
- If you find compromise, contact Cisco TAC and treat the configurations the Manager pushed to edge devices as suspect.
How this could have been avoided
- Keep the controller off the public internet. SD-WAN Manager controls every branch. Management network only, with MFA on the way in.
- Least privilege on accounts. The path traversal needed write access. Fewer write accounts means fewer ways in.
- Watch the deployment directory. A new
.warfile is a rare, high signal event. File integrity monitoring on the application server catches the exact step attackers used. - Limit outbound connections from the Manager. A deployed web shell gains little if it cannot call out.
Why it matters
Controllers amplify bugs: one box pushes configuration to many routers. A flaw that looks like "medium, needs credentials" scores 6.5 here, yet it reached KEV. Severity scores describe the bug, not the blast radius.
Try it yourself
List the management planes you run, such as SD-WAN controllers, firewall managers and hypervisor consoles, and for each write down who can reach it and with which accounts.
Click through it at your own pace, or open it full screen.
Quick check
Do you need two separate patches?
No. Cisco states the fix for both CVEs is the same, so one upgrade to a fixed release covers both.
What did attackers deploy on compromised managers?
A malicious .war file that WildFly deployed as a web application, which they then commanded with POST requests.
