Path traversal in Cisco Catalyst SD-WAN Manager (CVE-2026-20262) — an authenticated attacker can create or overwrite arbitrary files

1What path traversal is

Path traversal is a flaw in which mixing "../" and the like into a file path reaches files outside the intended range. Here, that is said to let an attacker create files on the affected system or overwrite any file. Overwriting files can, through tampering with configuration files or planting malicious files, become a foothold for seizing the system or for further compromise.

2Catalyst SD-WAN Manager as the target

The target, Cisco Catalyst SD-WAN Manager, is the command post that centrally manages an enterprise's SD-WAN (a wide-area network flexibly configured by software). Because network-management products hold the core of communications — settings and routing — writing files to them tends to have wide impact.

The CVSS published on NVD is 6.5 (MEDIUM); the attack requires some privilege (PR:L, i.e. authentication), but the impact to integrity (I:H) is rated high.

3Why a medium score still enters KEV

The number is MEDIUM, but CISA's addition to the KEV means this flaw is being exploited in real attacks. Regardless of a high or low CVSS, weaknesses in widely used network-management products become real targets — being on the KEV is the proof. The response is prompt updating per Cisco's guidance.

4What CVSS says, and what KEV says

The CVSS here is 6.5, medium. On the number alone it looks postponable, yet the fact of being on KEV says something else.

Path traversal is the vulnerability in which mixing sequences such as "../" into a path specification reaches files outside the permitted range. Overwriting a file leads, through altered configuration or a planted file, to control of the system or a foothold for further compromise. A weakness in a widely used network management product becomes a real target whatever the CVSS.