EUVD-2026-36733
GHSA-p45r-gcc9-fr7f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege SD-WAN Manager credentials
-
DeliveryAuthenticate to web UI and identify file upload API endpoint
-
ExploitSend crafted HTTP POST with path traversal sequences in filename or path parameter
-
ExecutionOverwrite OS-level file (e.g., cron job, authorized_keys, or sudoers entry)
-
PersistTrigger execution of written payload
-
ImpactAchieve root-level access on SD-WAN Manager host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires possession of valid Cisco Catalyst SD-WAN Manager credentials at a minimum of the 'lower-privileged, single-task' role - this is the lowest defined access tier in the platform, not administrator access, meaning any authenticated user is a potential threat actor. The attacker must have network-level reachability to the SD-WAN Manager web UI and API endpoints (AV:N, no special network positioning such as adjacency is required). No user interaction from a victim is required (UI:N), and no complex preconditions or non-default configurations are needed beyond the presence of a valid user account. Unauthenticated exploitation is not possible - the PR:L requirement is the definitive exploitation gate. The path traversal specifically occurs during the file upload workflow, so the upload API endpoint must be reachable to the attacker's authenticated session. The primary factors limiting exploitation are: (1) mandatory credential possession at any privilege level, and (2) network access to the management interface, which should be restricted to administrative networks in well-hardened deployments. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N yields a 6.5 Medium score, which underrepresents the true operational risk. The network attack vector (AV:N) and low complexity (AC:L) indicate the exploit is straightforward once credentials are in hand; however, the low-privilege authentication requirement (PR:L) is the primary limiting factor - exploitation is not unauthenticated. No EPSS data was provided in the available intelligence, limiting probabilistic exploitation forecasting. The vulnerability is not listed in CISA KEV, and no public POC has been identified, so no confirmed active exploitation exists at time of analysis. Despite the Medium CVSS score, the real-world impact severity is elevated: arbitrary file write with a root escalation path on the SD-WAN Manager host represents a full infrastructure takeover vector given the platform's role managing network-wide SD-WAN policy. The CPE wildcard version string suggests broad product coverage with no version-based exclusion. A key conflict to flag: the CVSS Scope is Unchanged (S:U), yet successful root escalation could subsequently affect all SD-WAN devices managed by this platform - defenders should treat the blast radius as potentially wider than the base score reflects. The primary risk gate is credential access, making phishing, password spray, and insider threat the realistic attacker on-ramps. |
| Exploit ScenarioDerived | An attacker who has acquired a low-privileged single-task account on Cisco Catalyst SD-WAN Manager - obtained through credential phishing, password spraying against exposed management interfaces, or insider access - authenticates to the web UI and submits a crafted HTTP POST request to the file upload API endpoint with path traversal sequences embedded in the filename or destination path parameter (e.g., '../../var/spool/cron/root'). The server writes attacker-controlled content - a reverse shell cron entry or malicious SSH public key - directly to the OS filesystem, which is subsequently executed with root-level privileges, granting the attacker full control of the SD-WAN Manager host and the ability to manipulate SD-WAN policy across the entire managed network. No public POC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 15, 2026
Arbitrary file write via path traversal in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticated low-privileged attacker to create or overwrite any file on the underlying operating system by sending crafted HTTP requests to affected API endpoints. The vulnerability stems from insufficient validation of user-supplied input during the file upload process (CWE-22), and a successful exploit can serve as a reliable stepping stone to root-level privilege escalation on the management host. No public exploit has been identified at time of analysis, and the vulnerability is not currently listed in CISA KEV; however, the integrity impact combined with root escalation potential elevates real-world risk above the CVSS 6.5 Medium baseline.
RemediationAI
Apply the vendor-supplied patch by consulting the Cisco Security Advisory cisco-sa-sdwan-arbfw-c2rZvQ at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ for specific fixed release versions; a confirmed fixed version number was not available in the provided intelligence data and must not be assumed. While awaiting patching, restrict network access to the SD-WAN Manager web UI and API endpoints to trusted administrative IP ranges via ACLs or firewall rules - this does not prevent exploitation by already-credentialed internal attackers but reduces exposure to external threats. Audit and remove unnecessary low-privileged single-task user accounts from SD-WAN Manager to minimize the credential attack surface, noting this is a reduction, not elimination, of risk. Enable verbose API access logging on SD-WAN Manager to detect anomalous file upload requests, particularly those containing path traversal sequences such as '../' in path parameters. Disabling the file upload feature entirely would eliminate this specific vector but may disrupt legitimate management workflows and should be evaluated against operational requirements.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, Path Traversal) within the web UI file upload subsystem of Cisco Catalyst SD-WAN Manager. The affected product is identified by CPE cpe:2.3:a:cisco:cisco_catalyst_sd-wan_manager:*:*:*:*:*:*:*:*, where the wildcard version component indicates that all tracked versions are potentially affected. The web management platform exposes API endpoints that accept file uploads; without proper canonicalization or path restriction, an attacker can inject directory traversal sequences (e.g., '../../etc/cron.d/') into the upload path parameter to escape the intended staging directory and write to arbitrary OS-level locations. Because the SD-WAN Manager service process likely runs with elevated OS privileges, files written through this mechanism - such as cron jobs, SSH authorized_keys entries, or sudoers modifications - can subsequently be executed to achieve root access. This chained exploitation pattern is a well-understood consequence of unrestricted arbitrary file write primitives.
Know when Cisco Catalyst Sd Wan Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-accessible API requires only low-privilege credentials (PR:L); path traversal yields high integrity impact with no direct confidentiality or availability consequence.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.
This vulnerability exists because the affected software does not properly validate user-supplied input during a file upload process. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected API endpoint of the affected system. A successful exploit could allow the attacker to create or overwrite any file on the underlying operating system. This file could later be used to elevate to root. To exploit this vulnerability, the attacker must have valid credentials with at least a lower-privileged, single-task user account.
Articles & Coverage 1
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote unauthenticated attackers can bypass peering authentication in Cisco Catalyst SD-WAN Controller (vSmart) and SD-W
Authentication bypass in Cisco Catalyst SD-WAN Manager (vManage) allows an unauthenticated remote attacker to reach a re
Local privilege escalation in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) allows an authenticated netadmin u
Privilege escalation and cross-boundary information disclosure in Cisco Catalyst SD-WAN Manager and SD-WAN Controller st
Privilege escalation and authentication-boundary bypass in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows a
Privileged file manipulation in Cisco Catalyst SD-WAN Manager and SD-WAN Controller allows an authenticated attacker to
Cleartext storage of sensitive information in Cisco Catalyst SD-WAN Controller and Manager exposes credentials or other
Remote file disclosure in Cisco Catalyst SD-WAN Manager allows unauthenticated attackers to read arbitrary system files
Remote availability disruption in Cisco Catalyst SD-WAN Manager and Controller allows a low-privileged authenticated att
Cleartext credential exposure in Cisco Catalyst SD-WAN Manager's web-based management interface allows an authenticated
Cisco Catalyst SD-WAN Manager's web interface contains a reflected cross-site scripting (XSS) vulnerability that require
Cisco Catalyst SD-WAN Manager web UI fails to properly redact sensitive information in device configurations and templat
Exploit-DB