Cisco patches exploited SD-WAN manager vulnerability

Cisco has disclosed a new security vulnerability in its widely used network management software that has already been exploited by attackers, marking the latest in a sustained campaign targeting the company's products this year. The flaw, identified as CVE-2026-20262, affects the Cisco Catalyst SD-WAN Manager, formerly known as SD-WAN vManage, which serves as the central management console for Cisco's software-defined wide area network infrastructure.

The vulnerability is a path traversal flaw in the software's web user interface. According to Cisco, an authenticated attacker with valid credentials and at least write access can send a specially crafted HTTP request to an affected API endpoint. A successful exploit allows the attacker to create or overwrite any file on the underlying operating system, which could later be leveraged to gain root-level privileges. The issue stems from insufficient validation of user-supplied input.

Cisco stated its Product Security Incident Response Team discovered the flaw during internal security testing and became aware of its active exploitation earlier in June 2026. The company described the observed attacks as "limited," suggesting a targeted...