VulnRadar

Data against noise.

Built with NaN
Page generated: 11 Nov 2026, 10:02 UTC
← Dashboard

CVE-2026-20262

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affected software does not …

Read full description
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affected software does not properly validate user-supplied input during a file upload process. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected API endpoint of the affected system. A successful exploit could allow the attacker to create or overwrite any file on the underlying operating system. This file could later be used to elevate to root. To exploit this vulnerability, the attacker must have valid credentials with at least a lower-privileged, single-task user account.
CVSS 6.5 (MEDIUM) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
8.1/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 6.5: +0.97
  • Fresh EPSS: 29.12%: +0.15

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 10 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

The Hacker News
Press · 30 Sep 2026, 07:00 · Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager - The Hacker News
The Hacker News
Press · 24 Jun 2026, 07:00 · Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root - The Hacker News
The Hacker News
Press · 16 Jun 2026, 07:00 · Cisco Releases Security Updates for Actively Exploited SD-WAN Manager Flaw - The Hacker News
Help Net Security
Press · 16 Jun 2026, 07:00 · Cisco discloses second exploited SD-WAN vulnerability in two weeks (CVE-2026-20262) - Help Net Security
SecurityWeek
Press · 16 Jun 2026, 07:00 · Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks - SecurityWeek
See all 10 source documents
Security Affairs
Press · 16 Jun 2026, 07:00 · CVE-2026-20262: CISCO Catalyst SD-WAN Flaw Under Active Targeted Exploitation - Security Affairs
SOC Prime
Press · 16 Jun 2026, 07:00 · CVE-2026-20262: Cisco SD-WAN Manager Zero-Day Can Lead to Root Privilege Escalation - SOC Prime
Security Affairs
Press · 16 Jun 2026, 07:00 · U.S. CISA adds Cisco Catalyst and LiteSpeed cPanel plugin flaws to its Known Exploited Vulnerabilities catalog - Security Affairs
csoonline.com
Press · 16 Jun 2026, 07:00 · Cisco patches SD-WAN flaw amid evidence of active exploitation - csoonline.com
BleepingComputer
Press · 15 Jun 2026, 07:00 · Cisco fixes SD-WAN vManage flaw exploited in zero-day attacks - BleepingComputer

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.1 (2026-11-02 15:14). The curve appears once the score changes.

Public exploit evidence

1

Public exploit entries / repo candidates

See 1 repos with metrics
RepositoryStarsForksLanguageUpdated
fevar54/CVE-2026-20262-Cisco-Catalyst-SD-WAN-Manager-Arbitrary-File-Write-11Python17 Jun 2026, 16:40
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 6.5; EPSS 29.1%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
network access, low privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 14:00:00.097835+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
Added to the CISA KEV catalog
15 Jun 2026, 00:00
First press mention
15 Jun 2026, 07:00
Published
15 Jun 2026, 16:21
Latest press mention
30 Sep 2026, 07:00
Score calculated
05 Nov 2026, 14:00
PoCs on GitHub
1 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar