CVE-2026-20122

77

FAUCET Score

CVE-2026-20122 is a vulnerability in the API of Cisco Catalyst SD-WAN Manager that allows an authenticated, remote attacker to overwrite arbitrary files on the local file system. This flaw is due to improper file handling within the API interface. The vulnerability has a CVSS score of 5.4 (Medium), indicating a network-based attack requiring low privileges and no user interaction, potentially leading to limited impact on confidentiality and integrity. A successful exploit could grant vmanage user privileges. While no public exploit code is available (Metasploit, Nuclei, ExploitDB), Cisco has confirmed active exploitation of similar Catalyst SD-WAN flaws in the wild, and this CVE has garnered significant community discussion and media coverage.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 20.9.8.2CPE matchmatch criteria	cpe:2.3:a:cisco:catalyst_sd-wan_manager::::::::
		>= 20.10, < 20.12.5.3CPE matchmatch criteria	cpe:2.3:a:cisco:catalyst_sd-wan_manager::::::::
		>= 20.13, < 20.15.4.2CPE matchmatch criteria	cpe:2.3:a:cisco:catalyst_sd-wan_manager::::::::
		>= 20.16, < 20.18.2.1CPE matchmatch criteria	cpe:2.3:a:cisco:catalyst_sd-wan_manager::::::::
		20.12.6CPE matchmatch criteria	cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.6:::::::*

CVSS Data

CVSS version used by this source: 3.1

5.4MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

Exploitability Score

2.8

Impact Score

2.5

CvssVersion

3.1

Exploit Intelligence

EPSS Score

24.59%

Probability of exploitation in next 30 days

EPSS Percentile

97.7%

Percentile rank of EPSS score among Peer Group

As of 2026-07-24

Model: v2026.06.15

Added to KEV · Apr 20, 2026

This CVE's current EPSS score of 0.2459 is in the 99th percentile among its peer group of 21,951 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (10)

gcppatch availablevia llm_extracted

Fixed in: 1.2

opensipspatch availablevia llm_extracted

Fixed in: 1.2

3cxvendor investigatingvia llm_extracted

amazonvendor investigatingvia llm_extracted

ciscovendor investigatingvia nvd_reference

horillavendor investigatingvia llm_extracted

inveniosoftwarevendor investigatingvia llm_extracted

jitsivendor investigatingvia llm_extracted

leantimevendor investigatingvia llm_extracted

nutanixvendor investigatingvia llm_extracted

Vendor Advisories (9)

opensipsllm-opensips-bf4778697c828122CRITICAL

Cisco Catalyst SD-WAN Vulnerabilities

amazonllm-amazon-905b49fbaedc87d1MEDIUM

Cisco Catalyst SD-WAN Manager Arbitrary File Write (CVE-2026-20122)

nutanixllm-nutanix-30279bb214dbc402MEDIUM

Cisco Catalyst SD-WAN Manager Arbitrary File Write (CVE-2026-20122)

horillallm-horilla-d6d2864458148ed4MEDIUM

Cisco Catalyst SD-WAN Manager Arbitrary File Write (CVE-2026-20122)

leantimellm-leantime-52923804ad1e7328MEDIUM

Cisco Catalyst SD-WAN Manager Arbitrary File Write (CVE-2026-20122)

jitsillm-jitsi-93f2544c6ab4579dMEDIUM

Cisco Catalyst SD-WAN Manager Arbitrary File Write (CVE-2026-20122)

3cxllm-3cx-2f77dd59aa328d1bMEDIUM

Cisco Catalyst SD-WAN Manager Arbitrary File Write (CVE-2026-20122)

inveniosoftwarellm-inveniosoftware-0790f703b2c23930MEDIUM

Cisco Catalyst SD-WAN Manager Arbitrary File Write (CVE-2026-20122)

gcpllm-gcp-582ab54c9a587fb8CRITICAL

Cisco Catalyst SD-WAN Vulnerabilities

References

cisa.gov / known-exploited-vulnerabilities-catalog

US Government Resource

sec.cloudapps.cisco.com / security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v

Vendor Advisory