Cisco on Monday warned customers about yet another SD-WAN product zero-day exploited in attacks.
The flaw, tracked as CVE-2026-20262, has been described as a medium-severity arbitrary file write issue affecting Catalyst SD-WAN Manager.
An attacker can send specially crafted HTTP requests to an affected API endpoint to create or overwrite any file on the underlying operating system.
“This file could later be used to elevate to root,” Cisco explained, adding, “To exploit this vulnerability, the attacker must have valid credentials with at least write access.”
Cisco said it discovered the vulnerability internally and became aware of its exploitation in June 2026.
