Risk Letters
About Sign in ENDA

Exploited vulnerability

CVE-2026-20122

TLP:CLEAR

Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability

Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.

Facts

  • Vendor: Cisco
  • Product: Catalyst SD-WAN Manger
  • CVSS: 5.4
  • EPSS (probability of exploitation within 30 days): 25.8 %
  • On CISA's Known Exploited Vulnerabilities list since: 20 April 2026
  • First known exploitation: 20 April 2026
  • CISA's deadline for US federal agencies: 23 April 2026
  • Weakness: CWE-648
  • First seen by Risk Letters: 20 April 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD

© The Risk Letters 2026 · Privacy policy · Terms of sale · Refund policy