CVE-2026-20122
Cisco Catalyst Sd-Wan Manager ≤ 20.9.8.2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NSummary
CVE-2026-20122 is a medium-severity Incorrect Use of Privileged APIs (CWE-648) vulnerability in Cisco Catalyst Sd-Wan Manager. Its CVSS base score is 5.4 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Abuse Elevation Control Mechanism (T1548); ranked in the top 2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-20122 is a vulnerability in the API of Cisco Catalyst SD-WAN Manager that stems from improper file handling on the API interface. An authenticated, remote attacker with valid read-only credentials and API access could exploit this issue to overwrite arbitrary files on the local file system of the affected system.
To exploit the vulnerability, an attacker must possess valid read-only credentials granting API access to the Cisco Catalyst SD-WAN Manager. By uploading a malicious file via the API, the attacker can overwrite arbitrary files, potentially gaining vmanage user privileges. The CVSS v3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), associated with CWE-648.
Mitigation details are available in the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v. The vulnerability is also listed in the CISA Known Exploited Vulnerabilities Catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20122.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8673
Vulnerability Data
A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on…
more
the affected system. This vulnerability is due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.
- CWE(s)
- KEV Date Added
- See CISA KEV catalog
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.5.2V6.4.6
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover incorrect calls to privileged APIs before deployment.
Enforces authorization checks around privileged operations so that an API requiring elevated rights cannot be reached or misused without proper rights.
Least-privilege assignment directly reduces both the availability of privileged APIs and the blast radius when they are invoked incorrectly.
Security engineering principles include correct use of privileged interfaces and safe invocation patterns that stop the weakness from being introduced.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce correct usage of privileged APIs during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect incorrect privileged API calls but does not prevent them at design time.
Restricting privileged utility programs limits the exposure of privileged APIs to misuse.
Privileged access rights directly govern the correct use of privileged APIs and reduce misuse.
Secure development lifecycle includes API usage standards that can prevent incorrect privileged calls.
Application security requirements can specify correct invocation of privileged APIs.
Secure architecture principles guide proper privilege separation and API usage.