Cisco Releases Security Updates for Actively Exploited SD-WAN Manager Flaw

Cisco disclosed CVE-2026-20262, a medium-severity vulnerability in the web UI of Catalyst SD-WAN Manager that permits an authenticated user with write access to upload crafted files (e.g., WAR) to overwrite or create files on the filesystem and potentially obtain root; Cisco reported limited active exploitation in June 2026, published IOCs (suspicious WAR uploads in vmanage logs), released patches for affected releases, and CISA added the issue to its Known Exploited Vulnerabilities catalog.