CVE-2026-20122 — Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability

Overview

Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.

Vulnerability details

CVE ID

CVE-2026-20122

Vulnerability

Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability

Vendor

Cisco

Affected products

Cisco: Catalyst SD-WAN Manger

Severity

HIGH

Exploitation status

Actively exploited in the wild (CISA KEV)

EPSS score

6.1% probability of exploitation in 30 days · 93th percentile

Published

2026-04-20

Remediation guidance

CVE-2026-20122 is in CISA's Known Exploited Vulnerabilities (KEV) catalog — U.S. federal civilian agencies are required to remediate it under Binding Operational Directive 22-01. Treat it as a priority for every environment.

Apply the vendor's official security update for Cisco the affected product as soon as possible. Where a patch is unavailable, apply vendor mitigations or isolate/segment exposed systems.

FIRST EPSS estimates a 6.1% probability that CVE-2026-20122 will be exploited within the next 30 days (93th percentile of all CVEs) — useful for risk-based patch sequencing.

Hunt for indicators of compromise tied to this vulnerability and confirm logging/EDR coverage on affected assets.

Authoritative references

• NVD — National Vulnerability Database
• MITRE CVE Record
• CISA Known Exploited Vulnerabilities Catalog
• FIRST EPSS — Exploit Prediction Scoring

Related actively-exploited CVEs — Cisco