Cisco SD-WAN Root Privilege Escalation Zero-Day, CISA Orders Patching Within Two Weeks

On June 15, 2026, Cisco released a patch for a critical vulnerability in Catalyst SD-WAN Manager. The vulnerability, CVE-2026-20262, is the second zero-day exploitation case confirmed this month, allowing attackers to escalate privileges from a low-privileged account to root. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) immediately added it to its Known Exploited Vulnerabilities catalog and ordered federal agencies to apply the patch within two weeks.

Technical Details of the Vulnerability

CVE-2026-20262 stems from insufficient input validation in the file upload handling of the Catalyst SD-WAN Manager’s Web UI. According to Cisco’s security advisory, an attacker can send a crafted HTTP request to the relevant API endpoint to create or overwrite arbitrary files on the underlying operating system. Exploiting this file ultimately enables privilege escalation to root.

The CVSS score is 6.5 (Medium), because the attack requires the attacker to have valid credentials for at least a low-privileged single-task user account. However, given that obtaining valid credentials is not difficult in practice, this score should not be underestimated.

Confirmed Exploitation and CISA Response

Cisco PSIRT confirmed limited exploitation of this vulnerability in June 2026. The advisory states, “Cisco continues to strongly recommend upgrading to a fixed software release.” No workarounds exist, and all deployment types are affected.

CISA added CVE-2026-20262 to its Known Exploited Vulnerabilities catalog on June 15. It requires federal agencies to respond under Binding Operational Directive (BOD) 22-01, mandating patching within a two-week deadline.

Second SD-WAN Zero-Day in June

This vulnerability follows CVE-2026-20245, reported on June 4, as the second zero-day exploitation case for Catalyst SD-WAN Manager this month. CVE-2026-20245 was rated high severity, but no patch was available at the time of reporting. Cisco finally released fixes for all affected versions on June 12.

This marks the eighth Cisco SD-WAN-related vulnerability added to CISA’s Known Exploited Vulnerabilities catalog in 2026. This number suggests ongoing security quality challenges in the SD-WAN product line.

Impact and Countermeasures

All deployment types are affected, and no device configuration can mitigate the issue. The only countermeasure is upgrading to a fixed software version provided by Cisco. Organizations should prioritize patching at the highest level and immediately formulate an application plan.

Especially in environments where low-privileged account credentials are relatively easy to obtain, the risk of this vulnerability exceeds its CVSS rating. Given the consecutive reports of multiple vulnerabilities on the same management plane, security teams should consider reassessing the entire SD-WAN infrastructure.

Editorial Opinion

In the short term, this case highlights the reality that network device management planes are becoming established attack vectors. The occurrence of multiple zero-days on the same product in a short period suggests fundamental issues in code quality and security review processes within Cisco’s SD-WAN product line. Organizations should apply patches immediately while also tightening low-privileged account management.

From a long-term perspective, the gap between the medium CVSS score of 6.5 and the actual risk is problematic. A vulnerability that allows root-level access with only valid credentials is extremely serious for a network infrastructure product. SD-WAN vendors are at a point where they need to fundamentally redesign authentication and authorization mechanisms on management planes. Moreover, eight additions to the CISA catalog likely reflect architectural-level design weaknesses rather than a simple chain of vulnerabilities.

An editorial question: Should Cisco disclose a root cause analysis and prevention measures for why multiple zero-day vulnerabilities occur on the same product in a short time? Additionally, if there is a gap between CVSS ratings and actual exploitation risks for network infrastructure products, should the industry discuss revising the evaluation criteria? These points are critical for all professionals involved in network security.

References

• The Register: Cisco SD-WAN make-me-root bug under attack — Published 2026-06-15
• Cisco Security Advisory CVE-2026-20262 (official Cisco)