Cisco Releases Security Updates for Actively Exploited SD-WAN Manager Flaw
Summary: Cisco released security updates for CVE-2026-20262, a medium-severity flaw with a CVSS score of 6.5 in the web UI of Catalyst SD-WAN Manager that allows an authenticated, remote attacker with at least write access to create or overwrite any file on the filesystem via crafted HTTP requests to an API endpoint, potentially escalating to root. Cisco said it became aware of limited exploitation in June 2026, discovered the issue during internal security testing, and CISA added the flaw to its KEV catalog with a June 29, 2026 deadline for FCEB agencies.
Why it matters: This is the eighth Cisco SD-WAN flaw flagged as actively exploited this year, and exploitation of some of those flaws has been attributed to an APT actor named UAT-8616 - a pattern that suggests sustained targeting of this product line rather than a one-off.