Is CVE-2022-20775 (Cisco SD-WAN Path Traversal) being exploited in the wild?

Yes. CISA added CVE-2022-20775 to its Known Exploited Vulnerabilities catalogue on 25 February 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Cisco SD-WAN CLI contains a path traversal vulnerability that could allow an authenticated local attacker to gain elevated privileges via improper access controls on commands within the application CLI.

What CVE-2022-20775 means for exposure assessment

CVE-2022-20775 is a Cisco SD-WAN CLI path traversal issue, so the first question is not whether the product is used somewhere in the environment, but whether any exposed management plane still allows the vulnerable CLI path to be reached. For a vulnerability that CISA has already placed in the KEV catalogue, the practical assumption is that exploitation is no longer theoretical and triage should move from “is this interesting?” to “where is this reachable?”

That distinction matters because path traversal defects often become operationally serious only when they sit behind administrative workflows, automation, or remote management surfaces. If the vulnerable CLI is present but not reachable from any trusted admin path, the risk profile is different from a device that is internet-facing, broadly reachable inside a management network, or exposed through delegated operational access.

The most useful exposure check is to map every Cisco SD-WAN instance, confirm whether the affected CLI is enabled in your deployment pattern, and identify who or what can invoke it. If your inventory is incomplete, the question is already unresolved, because you cannot tell whether the vulnerability is dormant, reachable, or already part of the attack surface.

How active exploitation changes the response

Once a vulnerability is known to be exploited in the wild, patch planning should be treated as an incident-adjacent activity rather than routine hygiene. The CISA KEV catalogue exists to force that shift in priority, and a KEV listing means defenders should assume opportunistic scanning and follow-on exploitation are plausible even if no compromise has yet been observed locally.

For this kind of issue, the correct response is to follow the vendor advisory and the CISA KEV entry for version-specific remediation steps, then reduce exposure immediately if patching cannot happen at once. In practice that usually means limiting administrative reachability, tightening who can use the affected management functions, and preserving logs and device state long enough to determine whether the issue was touched before the fix was applied.

Zero-Day and Exploited Vulnerabilities Guide is the right internal reference when the question is about KEV-driven urgency, emergency mitigation, and post-patch hunting. For operational prioritisation, Vulnerability Management Guide covers the triage pattern practitioners need when exploited vulnerabilities must be ranked, mitigated, and verified quickly.

What to verify before you call it contained

Containment is not just “we installed a fix.” You need to verify whether the vulnerable path was reachable before remediation, whether any administrative sessions touched the CLI in the exposure window, and whether the device shows signs of privilege abuse or unusual command activity. If the flaw can elevate a local authenticated attacker, then any suspicious local access, management-plane anomaly, or unexpected configuration change deserves attention.

That verification step matters because exploited management-plane vulnerabilities often leave little obvious telemetry unless teams know what to look for. Check logs, command history, admin authentication events, and any change records associated with the SD-WAN control plane. If you cannot reconstruct who accessed the device and when, assume your detection coverage was weaker than your patching coverage.

For teams that already treat Cisco infrastructure as a recurring threat surface, the broader pattern is worth noticing. Cisco Active Directory credentials leak 2025 and Salt Typhoon telecom intrusions 2025 show why Cisco-related exposure often becomes a credential, access, and persistence problem, not just a single-device vulnerability issue. CISA Known Exploited Vulnerabilities Catalog and NIST National Vulnerability Database are the external sources to use for authoritative status and record-level tracking.

Risk and Threat Considerations

The main risk is not the abstract existence of a path traversal bug, but the combination of active exploitation, privileged CLI access, and management-plane trust. When an authenticated local attacker can cross access boundaries inside an administrative interface, the likely failure mode is privilege expansion inside a high-trust system, which can turn a narrow foothold into configuration tampering or broader network control.

Failure mechanism: A vulnerable CLI command path can be abused to bypass intended access controls, allowing an authenticated local attacker to traverse restricted paths and reach elevated functions or data.

Impact: The attacker may gain higher privileges on the SD-WAN control plane, alter routing or management settings, and use that position to support follow-on compromise or persistence.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-4 — Secure Configuration of Enterprise Assets and Software	CVE triage depends on reducing reachable exposure on Cisco SD-WAN systems.
	CIS-7 — Continuous Vulnerability Management	The question is about an actively exploited CVE and fast remediation priorities.
Recommendation — Harden SD-WAN management exposure and remove unnecessary administrative reachability. Prioritise KEV-listed vulnerabilities for rapid remediation and verification.
NIST CSF 2.0	GV.RM-01 — Risk Management Strategy	Active exploitation requires risk-based prioritisation and exception handling.
	PR.IR-01 — Networks and environments are protected from threats using safeguards	Limiting access to the vulnerable SD-WAN management path is a protective safeguard.
	DE.CM-01 — Networks and systems are monitored to find anomalies	Verification after active exploitation requires monitoring for suspicious CLI and admin activity.
Recommendation — Escalate KEV-listed issues into the organisation's highest-priority risk workflow. Constrain management-plane access to reduce exploitability. Monitor SD-WAN management activity for signs of exploitation or misuse.

Practitioner Guidance

What to prioritise: Treat this as a management-plane exposure problem first. Confirm whether any Cisco SD-WAN nodes are reachable by users, automation, or jump hosts that do not strictly need that access, then reduce exposure before you wait for ideal maintenance windows.

What to verify: Validate that the fix or mitigation actually closes the vulnerable path in your deployment model, not just in a lab build. If patching is delayed, verify compensating controls, logging, and session visibility so you can still detect use of the affected CLI.

Decision rule: If the device can be administered by more than the minimum required set of operators or systems, assume blast radius is larger than intended and tighten access before you finish retrospective analysis.

Practitioner takeaway: With a KEV-listed management vulnerability, the right question is not whether exploitation is possible in the abstract, but whether your environment still gives an attacker a reachable, privileged path to try it.