Cisco Patches Actively Exploited Zero-Day in Catalyst SD-WAN Manager

#cybersecurity #infosec

Summary

Cisco patched an actively exploited zero-day vulnerability (CVE-2026-20262) in its Catalyst SD-WAN Manager that allows authenticated attackers to gain root access through arbitrary file writes.

Take Action:

Make sure your Cisco Catalyst SD-WAN Manager is isolated from the internet and reachable only from trusted networks. This is an actively exploited flaw so don't ignore it. Update ASAP to one of the fixed versions (20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, or 26.1.1.2) and check your logs for suspicious uploads like .war or index.jsp files.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines