Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability

CVE-2026-20122 is an arbitrary file overwrite bug in the Cisco Catalyst SD-WAN Manager API. In the vulnerable trains, an attacker with valid read-only API credentials can upload data that lands where it should not on the local filesystem, which can be turned into vmanage user access. Affected releases are broad: earlier than 20.9 must migrate, 20.9 before 20.9.8.2, 20.10/20.11 before 20.12.6.1, 20.12 before 20.12.5.3 plus 20.12.6, 20.13–20.15 before 20.15.4.2, and 20.16–20.18 before 20.18.2.1.

The original CNA/MITRE record labeled this MEDIUM 5.4, but that underrates reality for defenders because this bug is now KEV-listed and Cisco/Talos have tied it to real exploitation chains against exposed SD-WAN Manager systems. That said, the vendor-freefall into 'critical' still overstates the standalone case: by itself this is not unauthenticated initial access, and in most sane enterprises it needs either prior credentials or chaining with CVE-2026-20133 and CVE-2026-20128.

Why this verdict

• Active exploitation overrides comfort math: Cisco PSIRT, Talos, and CISA KEV all say this bug is not theoretical anymore.
• Control-plane amplifier: compromise lands on SD-WAN Manager, a box with outsized operational blast radius compared with an ordinary app server.
• Vendor baseline was too low for operations: starting from the original CNA 5.4 MEDIUM, I adjust upward for KEV listing, observed PoC-driven exploitation, and the fact that public-facing management nodes were actually being shelled.
• But there is real friction: unauthenticated remote initial access is not what CVE-2026-20122 gives you by itself; it needs read-only API credentials or a successful chain.
• Exposure is limited, not universal: hundreds of exposed nodes is serious for enterprise defenders, but it is nowhere near a mass-edge event affecting every VPN, browser, or mailbox.

Why not higher?

I am not calling this CRITICAL because the standalone exploit path is gated by PR:L and API access. In real terms, that means either prior compromise, credential theft, or successful chaining with other bugs; those are meaningful downward-pressure factors. Also, CVE-2026-20122 alone does not guarantee root or instant fabric-wide takeover.

Why not lower?

I am not leaving this at MEDIUM because defenders now have hard evidence that adversaries operationalized it and CISA put it in KEV. Once public PoC plus observed webshell deployment shows up on a management appliance, a paper-medium bug becomes a real patching priority.

1. Remove internet exposure now — Put SD-WAN Manager behind a VPN, jump host, or strict allowlist immediately, within hours because KEV/active exploitation overrides the normal HIGH mitigation clock. This is the cleanest way to cut off the observed PoC-driven chain.
2. Restrict API reachability — Allow only dedicated admin networks to hit the Manager API and block broad east-west access immediately, within hours. The bug lives on the API surface, so shrinking who can talk to it matters more than generic perimeter talking points.
3. Review IoCs and admin-techs — Pull and inspect serviceproxy-access.log, compare source IPs to known admin activity, and run Cisco's Check Bug Applicability Tool workflow immediately, within hours. If you were exposed, assume the goal was shell placement, not just harmless probing.
4. Rotate exposed service credentials — Rotate SD-WAN Manager admin/API credentials and any DCA-related secrets after containment immediately, within hours if there is any chance CVE-2026-20128 or this bug was touched. Credential reuse turns one box compromise into a cluster or cross-node problem.
5. Deploy network detections — Push IDS/IPS coverage using Cisco Talos signatures and alert on the documented API paths within hours for exposed or suspected-exposed environments. This will not fix the bug, but it improves detection while you work through patching.

Run this on each Cisco Catalyst SD-WAN Manager node over SSH or console as an administrative user that can execute show system status or show version. Example: bash check_cve_2026_20122.sh or bash check_cve_2026_20122.sh 20.12.6. Root is not required if the CLI commands are available to your account.

#!/usr/bin/env bash
# check_cve_2026_20122.sh
# Determine likely exposure to CVE-2026-20122 on Cisco Catalyst SD-WAN Manager.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

extract_version() {
  local input="$1"
  # Keep the first dotted numeric token, e.g. 20.12.6.1 or 20.7.0-185 -> 20.7.0
  echo "$input" | grep -Eo '[0-9]+(\.[0-9]+){1,3}' | head -n1
}

get_version() {
  if [[ $# -ge 1 && -n "${1:-}" ]]; then
    extract_version "$1"
    return 0
  fi

  local out ver

  if command -v show >/dev/null 2>&1; then
    out="$(show system status 2>/dev/null || true)"
    ver="$(echo "$out" | awk -F': *' '/^[[:space:]]*Version[[:space:]]*:/ {print $2; exit}')"
    ver="$(extract_version "$ver")"
    if [[ -n "$ver" ]]; then
      echo "$ver"
      return 0
    fi

    out="$(show version 2>/dev/null || true)"
    ver="$(extract_version "$out")"
    if [[ -n "$ver" ]]; then
      echo "$ver"
      return 0
    fi
  fi

  return 1
}

ver_to_sortkey() {
  local v="$1"
  local a b c d
  IFS='.' read -r a b c d <<< "$v"
  a=${a:-0}; b=${b:-0}; c=${c:-0}; d=${d:-0}
  printf '%03d%03d%03d%03d\n' "$a" "$b" "$c" "$d"
}

ver_lt() { [[ "$(ver_to_sortkey "$1")" < "$(ver_to_sortkey "$2")" ]]; }
ver_ge() { [[ "$(ver_to_sortkey "$1")" >= "$(ver_to_sortkey "$2")" ]]; }

VERSION="$(get_version "${1:-}")" || {
  echo "UNKNOWN - could not determine Cisco SD-WAN Manager version. Supply it explicitly, e.g.: bash $0 20.12.6"
  exit 2
}

if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+(\.[0-9]+){0,2}$ ]]; then
  echo "UNKNOWN - unrecognized version format: $VERSION"
  exit 2
fi

IFS='.' read -r MAJ MIN PAT BUILD <<< "$VERSION"
PAT=${PAT:-0}
BUILD=${BUILD:-0}

# This script implements Cisco's fixed-release table for CVE-2026-20122.
# Vulnerable:
# - earlier than 20.9 -> migrate
# - 20.9.x < 20.9.8.2
# - 20.10.x and 20.11.x
# - 20.12.x < 20.12.5.3 plus exact 20.12.6
# - 20.13.x to 20.15.x < 20.15.4.2
# - 20.16.x to 20.18.x < 20.18.2.1

if [[ "$MAJ" -ne 20 ]]; then
  echo "UNKNOWN - this checker only knows Cisco's 20.x SD-WAN Manager release mapping; detected $VERSION"
  exit 2
fi

if (( MIN < 9 )); then
  echo "VULNERABLE - $VERSION is earlier than 20.9 and must migrate to a fixed release"
  exit 1
fi

if (( MIN == 9 )); then
  if ver_lt "$VERSION" "20.9.8.2"; then
    echo "VULNERABLE - $VERSION is below 20.9.8.2"
    exit 1
  else
    echo "PATCHED - $VERSION is at or above 20.9.8.2"
    exit 0
  fi
fi

if (( MIN == 10 || MIN == 11 )); then
  echo "VULNERABLE - $VERSION must move to 20.12.6.1 or later per Cisco fixed-release guidance"
  exit 1
fi

if (( MIN == 12 )); then
  if [[ "$VERSION" == "20.12.6" ]]; then
    echo "VULNERABLE - 20.12.6 is explicitly affected; move to 20.12.6.1 or later"
    exit 1
  fi
  if ver_lt "$VERSION" "20.12.5.3"; then
    echo "VULNERABLE - $VERSION is below 20.12.5.3"
    exit 1
  fi
  if ver_ge "$VERSION" "20.12.6.1"; then
    echo "PATCHED - $VERSION is at or above 20.12.6.1"
    exit 0
  fi
  echo "PATCHED - $VERSION appears to be in the fixed 20.12.x range"
  exit 0
fi

if (( MIN >= 13 && MIN <= 15 )); then
  if ver_lt "$VERSION" "20.15.4.2"; then
    echo "VULNERABLE - $VERSION is below 20.15.4.2"
    exit 1
  else
    echo "PATCHED - $VERSION is at or above 20.15.4.2"
    exit 0
  fi
fi

if (( MIN >= 16 && MIN <= 18 )); then
  if ver_lt "$VERSION" "20.18.2.1"; then
    echo "VULNERABLE - $VERSION is below 20.18.2.1"
    exit 1
  else
    echo "PATCHED - $VERSION is at or above 20.18.2.1"
    exit 0
  fi
fi

echo "PATCHED - $VERSION is newer than the affected trains covered by Cisco's advisory"
exit 0

Sources

1. Cisco security advisory: Cisco Catalyst SD-WAN Vulnerabilities
2. NVD entry for CVE-2026-20122
3. Cisco Talos: Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities
4. Cisco: Verify SD-WAN PSIRT with the Check Bug Applicability Tool
5. CISA Known Exploited Vulnerabilities Catalog query
6. VulnCheck exposure analysis for Cisco SD-WAN Manager
7. CIRCL Vulnerability-Lookup for CVE-2026-20122