SecurityOnlineDo Son
Cisco SD-WAN Vulnerability Exploited in the Wild: Patch CVE-2026-20262 Now
Part of the CVE-2026-20262 story · since 15 Jun
Quiet for 19 weekslast report 16 Jun9 articles4 outlets
- Mon 15 Jun, 18:09 UTC. SecurityOnline, first report. Cisco SD-WAN Vulnerability Exploited in the Wild: Patch CVE-2026-20262 Now. Cites a CVE in CISA KEV. This article, 1st of 9.
- Mon 15 Jun, 19:41 UTC. CISA, its first report on the story. CISA adds Cisco SDWAN Manager CVE-2026-20262 to KEV list. Cites a CVE in CISA KEV.
- Mon 15 Jun, 20:17 UTC. CISA. CISA flags Cisco Catalyst SD WAN flaw CVE-2026-20262 in KEV list. Cites a CVE in CISA KEV.
- Tue 16 Jun, 01:30 UTC. SecurityOnline. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed. Cites a CVE in CISA KEV.
- Tue 16 Jun, 06:30 UTC. SecurityWeek, its first report on the story. Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV.
- Tue 16 Jun, 08:21 UTC. SecurityOnline. Inside the Stealthy Agent Tesla Infection Chain. Cites a CVE in CISA KEV.
- Tue 16 Jun, 09:29 UTC. Security Affairs, its first report on the story. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack. Cites a CVE in CISA KEV.
- Tue 16 Jun, 09:30 UTC. SecurityOnline. Could Apple Build Its Own OpenClaw Competitor?. Cites a CVE in CISA KEV.
- Tue 16 Jun, 11:30 UTC. Security Affairs. Cisco SD WAN manager flaw lets attackers write files, patch urged. Cites a CVE in CISA KEV.
A critical vulnerability in Cisco's SD-WAN Manager, tracked as CVE-2026-20262, is under active attack, posing significant risks to affected systems. The flaw, stemming from inadequate validation of user input during file uploads, allows authenticated attackers to overwrite or create files on the system, potentially escalating to root access. All deployment types, including On-Prem, Cloud-Pro, and government installations, are affected with a CVSS score of 6.5.
Cisco has confirmed ongoing exploitation, with indicators such as suspicious file uploads. Users are advised to immediately apply patches and restrict internet access to vulnerable systems.
How the story developed
Quiet for 19 weekslast report 16 Jun9 articles4 outlets
9 articles from 4 outlets since 15 Jun. Quiet since 16 Jun. This was the first report.
- Mon 15 Jun, 18:09 UTC. SecurityOnline, first report. Cisco SD-WAN Vulnerability Exploited in the Wild: Patch CVE-2026-20262 Now. Cites a CVE in CISA KEV. This article, 1st of 9.
- Mon 15 Jun, 19:41 UTC. CISA, its first report on the story. CISA adds Cisco SDWAN Manager CVE-2026-20262 to KEV list. Cites a CVE in CISA KEV.
- Mon 15 Jun, 20:17 UTC. CISA. CISA flags Cisco Catalyst SD WAN flaw CVE-2026-20262 in KEV list. Cites a CVE in CISA KEV.
- Tue 16 Jun, 01:30 UTC. SecurityOnline. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed. Cites a CVE in CISA KEV.
- Tue 16 Jun, 06:30 UTC. SecurityWeek, its first report on the story. Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV.
- Tue 16 Jun, 08:21 UTC. SecurityOnline. Inside the Stealthy Agent Tesla Infection Chain. Cites a CVE in CISA KEV.
- Tue 16 Jun, 09:29 UTC. Security Affairs, its first report on the story. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack. Cites a CVE in CISA KEV.
- Tue 16 Jun, 09:30 UTC. SecurityOnline. Could Apple Build Its Own OpenClaw Competitor?. Cites a CVE in CISA KEV.
- Tue 16 Jun, 11:30 UTC. Security Affairs. Cisco SD WAN manager flaw lets attackers write files, patch urged. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 9 articles as a listHide the list
- Mon 15 JunDay 03
- Cisco SD-WAN Vulnerability Exploited in the Wild: Patch CVE-2026-20262 Now18:09 · SecurityOnline · First report · Known exploited CVE · This article, 1st of 9
- CISA adds Cisco SDWAN Manager CVE-2026-20262 to KEV list19:41 · CISA · official · CISA alert · Known exploited CVE
- CISA flags Cisco Catalyst SD WAN flaw CVE-2026-20262 in KEV list20:17 · CISA · official · Known exploited CVE
- Tue 16 JunDay 16
- LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed01:30 · SecurityOnline · Known exploited CVE
- Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks06:30 · SecurityWeek · Known exploited CVE
Show 3 more from 16 Jun
- CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack09:29 · Security Affairs · Known exploited CVE
- Cisco SD WAN manager flaw lets attackers write files, patch urged11:30 · Security Affairs · Known exploited CVE