Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekEduard Kovacs

Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks

Part of the CVE-2026-20262 story · since 15 Jun

Quiet for 19 weekslast report 16 Jun9 articles4 outlets
15 Jun · SecurityOnline first23 Aug15 Sep8 OctNowThis article5th of 9
  • Mon 15 Jun, 18:09 UTC. SecurityOnline, first report. Cisco SD-WAN Vulnerability Exploited in the Wild: Patch CVE-2026-20262 Now. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 19:41 UTC. CISA, its first report on the story. CISA adds Cisco SDWAN Manager CVE-2026-20262 to KEV list. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 20:17 UTC. CISA. CISA flags Cisco Catalyst SD WAN flaw CVE-2026-20262 in KEV list. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 01:30 UTC. SecurityOnline. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 06:30 UTC. SecurityWeek, its first report on the story. Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV. This article, 5th of 9.
  • Tue 16 Jun, 08:21 UTC. SecurityOnline. Inside the Stealthy Agent Tesla Infection Chain. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:29 UTC. Security Affairs, its first report on the story. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:30 UTC. SecurityOnline. Could Apple Build Its Own OpenClaw Competitor?. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 11:30 UTC. Security Affairs. Cisco SD WAN manager flaw lets attackers write files, patch urged. Cites a CVE in CISA KEV.

Cisco has issued a warning regarding a zero-day vulnerability, tracked as CVE-2026-20262, affecting its Catalyst SD-WAN Manager. This medium-severity flaw allows attackers to exploit specially crafted HTTP requests to create or overwrite files on the operating system, posing a risk of elevating to root access if valid credentials are obtained. First discovered internally by Cisco, the vulnerability has been linked to limited and targeted exploitation since June 2026, likely by sophisticated threat actors.

CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, urging federal agencies to address it by June 29. This marks the eighth Cisco SD-WAN vulnerability detected in 2026.

How the story developed

All 9 articles
Quiet for 19 weekslast report 16 Jun9 articles4 outlets

9 articles from 4 outlets since 15 Jun. Quiet since 16 Jun. This was the 5th report, 12 hours after the first.

Now15 Jun16171829 OctFirst reportSecurityOnline · 15 Jun, 18:09This article5th of 9 · day 1
  • Mon 15 Jun, 18:09 UTC. SecurityOnline, first report. Cisco SD-WAN Vulnerability Exploited in the Wild: Patch CVE-2026-20262 Now. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 19:41 UTC. CISA, its first report on the story. CISA adds Cisco SDWAN Manager CVE-2026-20262 to KEV list. Cites a CVE in CISA KEV.
  • Mon 15 Jun, 20:17 UTC. CISA. CISA flags Cisco Catalyst SD WAN flaw CVE-2026-20262 in KEV list. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 01:30 UTC. SecurityOnline. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 06:30 UTC. SecurityWeek, its first report on the story. Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV. This article, 5th of 9.
  • Tue 16 Jun, 08:21 UTC. SecurityOnline. Inside the Stealthy Agent Tesla Infection Chain. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:29 UTC. Security Affairs, its first report on the story. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 09:30 UTC. SecurityOnline. Could Apple Build Its Own OpenClaw Competitor?. Cites a CVE in CISA KEV.
  • Tue 16 Jun, 11:30 UTC. Security Affairs. Cisco SD WAN manager flaw lets attackers write files, patch urged. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 9 articles as a list
  1. Mon 15 JunDay 03
    1. Cisco SD-WAN Vulnerability Exploited in the Wild: Patch CVE-2026-20262 Now18:09 · SecurityOnline · First report · Known exploited CVE
    2. CISA adds Cisco SDWAN Manager CVE-2026-20262 to KEV list19:41 · CISA · official · CISA alert · Known exploited CVE
    3. CISA flags Cisco Catalyst SD WAN flaw CVE-2026-20262 in KEV list20:17 · CISA · official · Known exploited CVE
  2. Tue 16 JunDay 16
    1. LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed01:30 · SecurityOnline · Known exploited CVE
    2. Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks06:30 · SecurityWeek · Known exploited CVE · This article, 5th of 9
    3. Inside the Stealthy Agent Tesla Infection Chain08:21 · SecurityOnline · Known exploited CVE
    Show 3 more from 16 Jun
    1. CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack09:29 · Security Affairs · Known exploited CVE
    2. Could Apple Build Its Own OpenClaw Competitor?09:30 · SecurityOnline · Known exploited CVE
    3. Cisco SD WAN manager flaw lets attackers write files, patch urged11:30 · Security Affairs · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in