CVE-2026-20122: 
Cisco SD-WAN Catalyst Manager vulnerability analysis and mitigation

CVE-2026-20122 is an arbitrary file overwrite vulnerability in the API of Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) that allows an authenticated remote attacker with read-only API credentials to overwrite arbitrary files on the local file system and gain vmanage user privileges. The vulnerability was first published on February 25, 2026, and active exploitation was confirmed by Cisco PSIRT in March 2026. It affects multiple Cisco Catalyst SD-WAN Manager releases across version branches 20.9 through 20.18, with specific fixed versions available. The CVSS v3.1 base score is 5.4 (Medium) per NVD, though the Cisco advisory assigns a higher severity of 7.1 (High) for this specific CVE within a broader advisory rated Critical (9.8) (Cisco Advisory, CISA KEV).

The root cause is classified as CWE-648 (Incorrect Use of Privileged APIs) — the API interface of Cisco Catalyst SD-WAN Manager performs improper file handling when processing uploaded files, failing to restrict the destination path. An attacker with valid read-only API credentials can exploit the /dataservice/smartLicensing/uploadAck endpoint by uploading a malicious file with a path-traversal filename (e.g., ../../../../../../../../../../../var/lib/wildfly/standalone/deployments/cmd.gz.war), causing the server to write the file to an arbitrary location on the filesystem. This path traversal technique allows the attacker to deploy a web shell or overwrite critical system files, ultimately escalating to vmanage user privileges. The vulnerability requires network access and low-privilege API credentials but no user interaction (Cisco Advisory).

Successful exploitation allows an authenticated attacker with read-only API access to overwrite arbitrary files on the Cisco Catalyst SD-WAN Manager system and escalate privileges to the vmanage user level. In observed in-the-wild attacks, threat actors chained this vulnerability with others in the same advisory (notably CVE-2026-20128 for credential theft and CVE-2026-20133 for information disclosure) to achieve deeper system compromise, including deployment of web shells (e.g., cmd.gz/cmd.jsp) and post-exploitation malware such as xmrig, Behinder, AdaptixC2, and Sliver. Because SD-WAN Manager is a central network orchestration platform, compromise can expose the entire SD-WAN fabric to lateral movement, configuration manipulation, and persistent access (Cisco Advisory, Tenable Blog).

1. Reconnaissance: Identify internet-facing Cisco Catalyst SD-WAN Manager instances using Shodan, Censys, or similar tools. Confirm the version is within the vulnerable range (e.g., 20.9.x before 20.9.8.2, 20.12.x before 20.12.5.3, 20.15.x before 20.15.4.2, or 20.16.x/20.18.x before 20.18.2.1).
2. Credential Acquisition: Obtain valid read-only API credentials for the target SD-WAN Manager. These may be acquired via phishing, credential stuffing, or by first exploiting CVE-2026-20128 (information disclosure of DCA credentials) or CVE-2026-20133 (unauthenticated sensitive information disclosure) to harvest credentials.
3. Authenticate to API: Use the obtained credentials to authenticate to the SD-WAN Manager REST API and obtain a valid session token.
4. Craft Malicious Upload Request: Send a crafted HTTP POST request to the /dataservice/smartLicensing/uploadAck endpoint, embedding a path-traversal filename in the uploaded file payload (e.g., ../../../../../../../../../../../var/lib/wildfly/standalone/deployments/cmd.gz.war) containing a JSP web shell.
5. Trigger File Write: The server processes the upload without validating the destination path, writing the malicious file (e.g., cmd.gz.war) to the WildFly application server's deployment directory, causing automatic deployment of the web shell.
6. Execute Commands via Web Shell: Access the deployed web shell at /cmd.gz/cmd.jsp to execute arbitrary OS commands with vmanage user privileges, enabling further lateral movement, credential harvesting, or malware deployment (xmrig, Behinder, Sliver, AdaptixC2) (Cisco Advisory, VulnCheck).

• Network: Unexpected HTTP POST requests to /dataservice/smartLicensing/uploadAck from non-administrator IP addresses; HTTP requests to /cmd.gz/cmd.jsp (a non-existent endpoint on clean systems); outbound connections from the SD-WAN Manager to unknown external IPs (C2 infrastructure associated with xmrig, Behinder, Sliver, AdaptixC2).
• Logs: Entries in /var/log/nms/containers/service-proxy/serviceproxy-access.log showing POST to /dataservice/smartLicensing/uploadAck from unexpected source IPs; entries referencing /cmd.gz/cmd.jsp (any access is an IOC); entries in /var/log/nms/vmanage-server.log showing path-traversal filenames such as ../../../../../../../../../../../var/lib/wildfly/standalone/deployments/cmd.gz.war being written.
• File System: Presence of /cmd.gz/cmd.jsp or similar web shell files in the WildFly deployment directory (/var/lib/wildfly/standalone/deployments/); unexpected .war or .gz.war files in deployment directories; new or modified files in system directories inconsistent with normal operations.
• Process: Unexpected child processes spawned by the WildFly/JBoss application server process (e.g., curl, wget, bash, cryptomining processes); presence of xmrig, Behinder, Sliver, or AdaptixC2 artifacts on the filesystem (Cisco Advisory).

Cisco has released fixed software versions and confirms there are no workarounds available. Organizations should upgrade to the following fixed releases based on their current version branch: 20.9.8.2 or later, 20.12.5.3 or later (or 20.12.6.1), 20.15.4.2 or later, or 20.18.2.1 or later. Releases earlier than 20.9 should migrate to a supported fixed release. CISA issued Emergency Directive ED-26-03 requiring federal agencies to remediate by April 23, 2026, and published supplemental Hunt & Hardening Guidance for Cisco SD-WAN devices. As interim hardening measures, Cisco recommends restricting SD-WAN Manager access to trusted hosts only (not exposed to the internet), placing the system behind a firewall, disabling HTTP for the web UI, enabling external log forwarding, and monitoring access logs for the IOCs described above (Cisco Advisory, CISA KEV).

Cisco's PSIRT confirmed active exploitation in March 2026 and updated the advisory multiple times, adding IOC guidance and strongly urging immediate upgrades. CISA issued Emergency Directive ED-26-03 and added CVE-2026-20122 to the KEV catalog with an unusually short 3-day remediation deadline for federal agencies, reflecting the severity of active exploitation. Tenable published detailed threat intelligence attributing exploitation to threat actor UAT-8616 and documenting the malware families deployed (Tenable Blog). Security media including BleepingComputer, SecurityWeek, The Register, and Cybersecurity Dive provided extensive coverage, and community discussions on Reddit and Mastodon highlighted the urgency for network administrators. Proofpoint published a threat insight blog noting the broader pattern of SD-WAN exploitation in 2026 (Proofpoint). Multiple national CERTs (Belgium, Canada, Australia, EU) issued advisories urging immediate action.