Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2026-20262

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affected software does not properly validate user-supplied input during a file upload process. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected API endpoint of the affected system. A successful exploit could allow the attacker to create or overwrite any file on the underlying operating system. This file could later be used to elevate to root. To exploit this vulnerability, the attacker must have valid credentials with at least a lower-privileged, single-task user account.

CVSS 6.5 · MediumBuzz score 69.0KEV listed

Buzz score

Why this CVE is surfacing

Buzz score total 69.0

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 24.0 · diversity 20.0 · KEV 25.0 · OTX 0.0 · PoC 0.0
Mention score
24.0
10 evidence mentions in the snapshot
Diversity score
20.0
7 sources across 5 categories
KEV score
25.0
Known exploited vulnerability present
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
10 source links · newest first
  • Security Affairs newsletter Round 582 by Pierluigi Paganini – INTERNATIONAL EDITIONSecurity Affairs

    A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Inside GentleKiller: The EDR-Killer Powering The Gentlemen FortiBleed Exposes Global Credential-Spraying Operation CISA Warns of Active […]

    newssecurityaffairs.comJun 21, 2026, 5:19 PM
  • Week in review: 74k Fortinet firewall credentials stolen, Splunk Enterprise RCE under active attackHelp Net Security

    Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: A hardware neural network backdoor that hides in plain sight Deep learning systems on edge devices often rely on third-party-designed FPGAs and ASICs for performance and efficiency, creating supply chain risks. Researchers from the University of Tennessee and the University of Florida developed HAMLOCK, a backdoor attack that splits malicious functionality between hardware and software, making detection more difficult. Onspring … More →

    newswww.helpnetsecurity.comJun 21, 2026, 8:00 AM
  • CVE-2026-20262: CISCO Catalyst SD-WAN Flaw Under Active Targeted ExploitationSecurity Affairs

    Cisco warned that CVE-2026-20262, a Catalyst SD-WAN Manager vulnerability allowing arbitrary file writes, is being actively exploited. Cisco confirmed active exploitation of CVE-2026-20262, an arbitrary file write vulnerability affecting Catalyst SD-WAN Manager. CVE-2026-20262 (CVSS score of 6.5) is an arbitrary file write vulnerability in the web interface of Cisco Catalyst SD-WAN Manager. The flaw is […]

    newssecurityaffairs.comJun 16, 2026, 10:53 AM
  • Cisco discloses second exploited SD-WAN vulnerability in two weeks (CVE-2026-20262)Help Net Security

    Cisco has revealed another Catalyst SD-WAN Manager vulnerability (CVE-2026-20262) that its Product Security Incident Response Team observed being exploited by attackers. But the associated security advisory also states that “the vulnerability was found during internal security testing”, raising the question of how attackers came to exploit it before Cisco had disclosed it publicly. The vulnerability (CVE-2026-20262) Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) is the management plane for the entire Cisco SD-WAN fabric. CVE-2026-20262 is … More →

    newswww.helpnetsecurity.comJun 16, 2026, 10:20 AM
  • U.S. CISA adds Cisco Catalyst and LiteSpeed cPanel plugin flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs

    U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Cisco Catalyst and LiteSpeed cPanel plugin flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Cisco Catalyst and LiteSpeed cPanel plugin flaws to its Known Exploited Vulnerabilities (KEV) catalog. The two flaws added to the catalog are: CVE-2026-20262 is an arbitrary […]

    newssecurityaffairs.comJun 16, 2026, 8:53 AM
  • Cisco Patches Another SD-WAN Zero-Day Exploited in AttacksSecurityWeek

    Cisco recently became aware of the exploitation of CVE-2026-20262, a Catalyst SD-WAN Manager zero-day that allows arbitrary file write.

    newswww.securityweek.comJun 16, 2026, 6:20 AM
  • Cisco Catalyst SD-WAN Manager Arbitrary File Write VulnerabilityCisco Security Advisories

    cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ Security Impact Rating: Medium CVE: CVE-2026-20262

    vendorsec.cloudapps.cisco.comJun 15, 2026, 10:00 PM
  • Cisco SD-WAN Manager arbitrary file write (CVE-2026-20262) – CISA KEVHacker News

    Linked URL: https://hellorecon.com/blog/cve-2026-20262 | Posted by slvnx | 3 points | 0 comments

    communitynews.ycombinator.comJun 15, 2026, 9:41 PM
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20262www.cisa.gov

    No excerpt available.

    Mitigationwww.cisa.govJun 15, 2026, 6:16 PM
  • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQsec.cloudapps.cisco.com

    No excerpt available.

    Vendor Advisorysec.cloudapps.cisco.comJun 15, 2026, 6:16 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence