Is CVE-2026-20262 (Cisco Catalyst SD-WAN Manager Directory or Path Traversal) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2026-20262 to its Known Exploited Vulnerabilities catalogue on 15 June 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.

What the KEV listing means for this Cisco SD-WAN issue

CISA’s KEV catalogue is the strongest practical signal here: if a flaw appears there, security teams should treat it as actively exploited and move it ahead of ordinary backlog triage. For this issue, the immediate question is not whether exploitation is possible in theory, but whether the affected Cisco Catalyst SD-WAN Manager instances are exposed and reachable for authenticated abuse.

When a directory or path traversal flaw is paired with authenticated access, the operational concern is often filesystem control rather than simple data reading. That means defenders should think about file creation, overwrite risk, and whether the application account can touch sensitive paths, startup files, or configuration locations.

For general handling of exploited vulnerabilities, use CISA Known Exploited Vulnerabilities Catalog as the prioritisation trigger and pair it with NIST National Vulnerability Database for the canonical CVE record, while the CVE Program remains the identifier source of record.

Why path traversal in a management plane matters

Management-plane vulnerabilities are high impact because they sit close to administrative workflows, trust boundaries, and privileged configuration. A traversal flaw in SD-WAN management can become a write primitive against the underlying host, which is far more dangerous than a simple web error page or limited application bug.

In practice, the main abuse paths are constrained by what the authenticated user can reach and what the application process can overwrite. If the process can write into predictable locations, the attacker may be able to alter scripts, config files, logs, or other operational artefacts that influence service behaviour.

That is why this class of flaw should be assessed as a systems issue, not only an application issue. It may require both application-layer fix verification and host-level review of any files or paths the service can touch.

What to check before and after remediation

Start by confirming whether the vulnerable Cisco Catalyst SD-WAN Manager instance is internet-facing, exposed through partner networks, or reachable by internal users who should not have administrative write-capable access. Then verify whether any suspicious files appeared, changed unexpectedly, or were overwritten around the time CISA added the CVE to KEV.

Use the vendor advisory and the KEV entry for version-specific remediation steps, and avoid relying on assumptions about deployment topology. If patching is delayed, isolate the management interface, restrict authenticated access to the smallest possible admin group, and monitor for unusual file writes, new web content, or changes in configuration state.

The most relevant triage aid for this kind of response is Zero-Day and Exploited Vulnerabilities Guide, because it focuses on KEV-driven prioritisation, emergency mitigation, and post-patch hunting. Teams that need a broader programme view should also use Vulnerability Management Guide to anchor remediation SLAs, verification, and exception handling.

Risk and Threat Considerations

This flaw matters because authenticated path traversal can turn a management login into filesystem control. Even without a full remote-code-execution claim, file creation or overwrite in a privileged management application can enable persistence, sabotage, configuration tampering, or staging for a broader intrusion.

Failure mechanism: The attacker abuses path handling in the management interface to reach files outside the intended directory boundary, then writes or overwrites content that the application or host later trusts.

Impact: Defenders may face altered configuration, service disruption, hidden persistence, or a foothold that survives routine application use unless the filesystem and process boundaries are reviewed carefully.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Actively exploited CVEs require prioritised scanning, tracking, and remediation.
Recommendation — Prioritise and remediate the KEV-listed flaw under your vulnerability management process.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	This question is about identifying and responding to an exploited vulnerability in a live environment.
	SI-2 — Flaw Remediation	The issue demands timely correction and validation of vulnerable software on the management plane.
Recommendation — Scan exposed Cisco SD-WAN assets and verify remediation status for the affected CVE. Apply the vendor fix and confirm the vulnerable component is no longer present or reachable.
NIST CSF 2.0	GV.RM-01 — Risk Management Strategy	KEV-listed exploitation should feed risk-based remediation prioritisation.
	DE.CM-01 — Monitor Networks and Information Systems	Exploitation in the wild warrants monitoring for suspicious activity around the exposed service.
Recommendation — Treat KEV inclusion as a high-priority risk signal in your remediation strategy. Monitor the SD-WAN management plane for anomalous access and file-change activity.

Practitioner Guidance

What to verify: Confirm whether the vulnerable instance can be reached by any authenticated account beyond the smallest necessary admin set, and verify whether the service account has write access to sensitive paths on the host. If the answer is yes to either, treat the exposure as urgent even if no direct compromise is yet visible.

Decision rule: If patching cannot happen immediately, prioritise containment, access restriction, and forensic review of file changes before you spend time on broader hunting. Once the fix is in place, validate that the vulnerable path is no longer reachable and that no unexpected files were created or modified during the exposure window.

Practitioner takeaway: For KEV-listed management-plane flaws, the real question is often not whether exploitation is theoretically possible, but whether the system already gave an attacker a durable filesystem-level change that deserves incident-style treatment.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org