United States issues emergency patch for Cisco SD-WAN flaw

•4mo ago

United States issues emergency patch for Cisco SD-WAN flaw

Tap title to read story

0:00 / 1:52

San Jose, California-based Cisco has released an emergency security update to fix a critical zero-day vulnerability in its Catalyst SD-WAN Manager, formerly known as vManage, which the company confirms is being actively exploited in the wild. Tracked as CVE-2026-20262, the flaw stems from a critical weakness in the file upload process that allows unauthenticated or low-privileged attackers to send a crafted HTTP request to an API endpoint and write arbitrary files directly to the appliance’s underlying filesystem. By overwriting key system files, a remote attacker can escalate privileges to root, bypass standard authentication controls, and potentially seize full control of the network management system, posing a severe risk to corporate and government networks.

The vulnerability affects all supported deployment models, including on-premises installations, Cisco SD-WAN Cloud-Pro, Cisco-managed cloud environments, and FedRAMP-certified versions used to manage sensitive U.S. government communications and data. Cisco has released patches for multiple software versions, including Release 20.9.9.1, 20.12.7.1, 20.15.4.4, 20.15.5.2, and 20.18.3, and urges network administrators to apply the fixes immediately because no workarounds are available. Security agencies have elevated the flaw to a top-priority issue and advise organizations using the affected SD-WAN Manager to review network logs for unauthorized file modifications or suspicious API activity that could indicate compromise.

Published 2026-06-16 11:05:43 UTC · Published by JQJO

Published by JQJO Editorial Desk · AI assisted

More context

Timeline

Earlier this year Vulnerability emerges in file handling
Recently Attackers begin active zero-day exploitation
This week Cisco detects widespread exploitation attempts
This week Cisco publishes detailed security advisory
This week Emergency patches released for multiple versions
This week Organizations urged to update SD-WAN Manager
Soon Security teams monitor for post-compromise activity

Why it matters

If you use Cisco's SD-WAN Manager, your network is at risk. Attackers could gain full control, posing a severe threat to your data. Check your system for unauthorized file changes or suspicious API activity. Update your software immediately.

JQJO Editorial Desk · Human reviewed · AI assisted. Report a correction.

Editorial policy and corrections · Our team

Mikita Balesni and Tomek Korbak, two former OpenAI safety researchers, gave their first interview since their dramatic dismissal. They discussed the company’s internal investigation into the Hugging Face hack and questioned the logic of OpenAI’s rebuttal. The interview also highlighted ongoing tensions over AI safety within the organization.

Cyber‑security firm Wiz Research announced on Wednesday that it had discovered severe security flaws in PHP, a programming language that powers about 70 percent of the world’s websites. OpenAI called the bug “one of the most impactful vulnerabilities in recent memory.” The flaws could allow attackers to take control of servers, steal data, and deface sites. Governments from the U.K. to Japan are rushing to patch affected sites. The U.S. National Security Agency warned organizations to maintain heightened awareness, while the U.K.’s National Cyber Security Centre urged immediate updates. Dozens of British, Finnish, French and Chinese government services were taken offline, and Japan’s Prime Minister Sanae Takaichi issued an urgent call for action. Cloudflare’s Matthew Prince reported tens of thousands of exploitation attempts in the first 45 minutes after the disclosure.

Anthropic deputy security chief Jason Clinton warned of a "vulnerability tsunami" that could expose critical infrastructure. He urged companies to patch core network vulnerabilities before exploitation. Andrew Curran highlighted active threats to energy, food, and water infrastructure, noting probing activity. He also reported a hack of Quest Diagnostics, which serves roughly half of U.S. hospitals. Matt Shumer warned of large‑scale disruptions from AI, describing a scenario where personal data leaks and service outages could occur. Shumer advised updating software, avoiding unfamiliar sites, and unplugging unused smart devices to protect accounts.