EUVD-2026-36733
GHSA-p45r-gcc9-fr7f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-accessible API requires only low-privilege credentials (PR:L); path traversal yields high integrity impact with no direct confidentiality or availability consequence.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.
This vulnerability exists because the affected software does not properly validate user-supplied input during a file upload process. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected API endpoint of the affected system. A successful exploit could allow the attacker to create or overwrite any file on the underlying operating system. This file could later be used to elevate to root. To exploit this vulnerability, the attacker must have valid credentials with at least a lower-privileged, single-task user account.
Articles & Coverage 1
AnalysisAI
Arbitrary file write via path traversal in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticated low-privileged attacker to create or overwrite any file on the underlying operating system by sending crafted HTTP requests to affected API endpoints. The vulnerability stems from insufficient validation of user-supplied input during the file upload process (CWE-22), and a successful exploit can serve as a reliable stepping stone to root-level privilege escalation on the management host. No public exploit has been identified at time of analysis, and the vulnerability is not currently listed in CISA KEV; however, the integrity impact combined with root escalation potential elevates real-world risk above the CVSS 6.5 Medium baseline.
Technical ContextAI
The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, Path Traversal) within the web UI file upload subsystem of Cisco Catalyst SD-WAN Manager. The affected product is identified by CPE cpe:2.3:a:cisco:cisco_catalyst_sd-wan_manager:*:*:*:*:*:*:*:*, where the wildcard version component indicates that all tracked versions are potentially affected. The web management platform exposes API endpoints that accept file uploads; without proper canonicalization or path restriction, an attacker can inject directory traversal sequences (e.g., '../../etc/cron.d/') into the upload path parameter to escape the intended staging directory and write to arbitrary OS-level locations. Because the SD-WAN Manager service process likely runs with elevated OS privileges, files written through this mechanism - such as cron jobs, SSH authorized_keys entries, or sudoers modifications - can subsequently be executed to achieve root access. This chained exploitation pattern is a well-understood consequence of unrestricted arbitrary file write primitives.
RemediationAI
Apply the vendor-supplied patch by consulting the Cisco Security Advisory cisco-sa-sdwan-arbfw-c2rZvQ at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ for specific fixed release versions; a confirmed fixed version number was not available in the provided intelligence data and must not be assumed. While awaiting patching, restrict network access to the SD-WAN Manager web UI and API endpoints to trusted administrative IP ranges via ACLs or firewall rules - this does not prevent exploitation by already-credentialed internal attackers but reduces exposure to external threats. Audit and remove unnecessary low-privileged single-task user accounts from SD-WAN Manager to minimize the credential attack surface, noting this is a reduction, not elimination, of risk. Enable verbose API access logging on SD-WAN Manager to detect anomalous file upload requests, particularly those containing path traversal sequences such as '../' in path parameters. Disabling the file upload feature entirely would eliminate this specific vector but may disrupt legitimate management workflows and should be evaluated against operational requirements.
Remote unauthenticated attackers can bypass peering authentication in Cisco Catalyst SD-WAN Controller (vSmart) and SD-W
Local privilege escalation in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticated netadmin u
Remote file disclosure in Cisco Catalyst SD-WAN Manager allows unauthenticated attackers to read arbitrary system files
Cisco Catalyst SD-WAN Manager's web interface contains a reflected cross-site scripting (XSS) vulnerability that require
Cisco Catalyst SD-WAN Manager web UI fails to properly redact sensitive information in device configurations and templat
Privilege escalation in Cisco Catalyst SD-WAN Manager allows authenticated users with read-only permissions to elevate p
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today