Cisco SD-WAN Manager Path Traversal Vulnerability (CVE-2026-20262) Advisory and Investigation Guide

Vulnerability Overview CVE Number: CVE-2026-20262 Vulnerability Type: Path Traversal Description: Cisco Catalyst SD-WAN Manager (formerly vManage) contains a path traversal vulnerability that allows authenticated remote attackers to create or overwrite arbitrary files on the file system. This vulnerability has a CVSS score of 6.5, is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and is reported as having limited exploitability. Successful exploitation may lead to privilege escalation to root. Affected Scope Affected Versions: - Cisco Catalyst SD-WAN Manager 20.9.9.1 and earlier - 20.10.7.1 and earlier - 20.15.4.4 and earlier - 20.15.5.2 and earlier - 20.18.3.1 and earlier - 20.18.11 and earlier Deployment Types: - On-Premise - Cloud-Pro - Cloud Managed - FedRAMP Government Remediation Patch: Immediately upgrade to the fixed versions: 20.9.9.2, 20.10.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, and 20.18.12. Restrict Management Access: Ensure the SD-WAN Manager Web UI (port 8443) is accessible only from the dedicated management network. Use Access Control Lists (ACLs) to block access from general user subnets and any Internet-facing interfaces. Audit User Accounts: Review all SD-WAN Manager user accounts, remove unused accounts, enforce strong passwords, and enable multi-factor authentication (MFA). Check Indicators of Compromise (IoCs): Review SD-WAN Manager audit logs for anomalous file upload activity or API calls. Look for unexpected files on the file system, modified configuration files, or new accounts. Review SD-WAN Fabric Policies: If the SD-WAN Manager is compromised, an attacker may modify device templates, policies, or routing configurations. Audit the running configurations of edge devices to verify expected baselines. Check All Deployment Types: On-Premise, Cloud-Pro, Cloud Managed, and FedRAMP versions are all affected. For cloud-hosted deployments (Cloud-Pro, Cloud Managed, FedRAMP), coordinate with Cisco TAC to confirm that patches have been applied on the Cisco-managed side. Investigation Workflow 1. Port Scanning: Discover SD-WAN Manager instances - Port 8443: Web UI (primary management interface) - Port 643: Web UI (alternative HTTPS port in some deployments) - Port 8040: SD-WAN Control Plane (NETCONF/YANG) - Port 830: NETCONF SSH - Port 6379: Internal Redis (cluster deployments) 2. TLS Inspection: Identify Cisco certificates - Inspect TLS certificates on port 8443, looking for Subject or Issuer fields containing Cisco, vManage, or SDWAN. 3. HTTP Headers: Fingerprint the Web UI - Probe port 8443 to look for fingerprints such as login pages, server headers, response bodies, and API endpoints. 4. DNS: Discover SD-WAN infrastructure - Query internal DNS for common SD-WAN Manager naming patterns. 5. CVE Lookup: Confirm the advisory - Retrieve the full NVD entry for CVE-2026-20262 and track score updates. External Data Cross-Reference SHODAN: Search for "vManage" on port 8443 or "Cisco SD-WAN" to find Internet-exposed instances. CVE Lookup: Obtain updated scores and references for CVE-2026-20262 in the NVD. CISA KEV: Listed on June 15, 2026; check the remediation deadline. Cisco Advisory: Cisco SD-WAN Advisory Sources Cisco Advisory: Cisco SD-WAN Advisory NVD: CVE-2026-20262 CISA Known Exploited Vulnerabilities Catalog --- Note: POC code or exploit code is not included in this document.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco SD-WAN Manager Path Traversal Vulnerability (CVE-2026-20262) Advisory and Investigation Guide