erroneo.us
Search all guides⌘K

Security Digest · Feb 25, 2026 · Vulnerability · Network edge

Cisco SD-WAN Manager CVE-2026-20122: Webshell File Overwrite

SD-WAN Manager API file overwrite, chained by a public PoC to plant webshells in Mar-Apr 2026. Fixed in 20.9.8.2, 20.12.6.1, 20.15.4.2, 20.18.2.1. Hunt.

Published By erroneo.us Security Desk · Updated 3 min read9 sources

Our verdict

Check exposure

Fixed since February and mass-exploited with a public PoC in March and April 2026: confirm every SD-WAN Manager is on a fixed release, then hunt for the upload and webshell traces Cisco and Talos describe.

Who must act: Anyone running on-prem or self-managed Catalyst SD-WAN Manager that was below a fixed release at any point after early March 2026, especially with the web UI or API reachable from untrusted networks.

Who can relax: Organizations without Catalyst SD-WAN, and Manager instances patched before March 2026 whose web and API interfaces were never exposed beyond a management network.

Affected
SD-WAN Manager releases earlier than 20.9 (migrate)
20.9 before 20.9.8.2
20.10 and 20.11 (move to 20.12.6.1)
20.12 before 20.12.5.3 / 20.12.6.1
20.13, 20.14 and 20.15 before 20.15.4.2
20.16 and 20.18 before 20.18.2.1
Fixed in
20.9.8.2
20.12.5.3 or 20.12.6.1
20.15.4.2
20.18.2.1
Later releases that fix CVE-2026-76504 (e.g. 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1)
CVSS
7.1 (v3.1, vendor)
EPSS
25.8% (percentile 98)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Inventory every SD-WAN Manager and confirm it runs a fixed release (show version); migrate anything older than 20.9 or on 20.10/20.11/20.13/20.14/20.16.
  2. Grep serviceproxy-access.log for POST /dataservice/smartLicensing/uploadAck and /cmd.gz/cmd.jsp, and vmanage-server.log for ../ paths into the WildFly deployments folder.
  3. List /var/lib/wildfly/standalone/deployments/ and investigate any WAR or JSP you did not deploy.
  4. If you find traces, collect request admin-tech output, open a TAC case and rebuild per Cisco's fabric rebuild guidance rather than cleaning in place.
  5. Restrict Manager web UI and API to management networks, and rotate admin, read-only API and DCA credentials plus any cloud keys stored on the Manager.

How to check if you are affected or compromised

  • POST /dataservice/smartLicensing/uploadAck in /var/log/nms/containers/service-proxy/serviceproxy-access.log from IPs that are not your licensing admins.
  • vmanage-server.log entries writing ../../var/lib/wildfly/standalone/deployments/<name>.war, and any request to /cmd.gz/cmd.jsp.
  • Requests for /reports/data/opt/data/containers/config/data-collection-agent/.dca (the CVE-2026-20128 step of the chain).
  • Talos webshell names (sysv.jsp, sysinit.jsp, conf.jsp, vmurnp_ikp.jsp, 20251117022131.jsp), XMRig or /tmp/moneroocean, gsocket, Sliver or AdaptixC2 implants, and loot_run.sh.

What happened#

On February 25, 2026, the same day as the CVE-2026-20127 peering bypass and ED 26-03 (covered in our February 25 brief), Cisco published a second advisory with five SD-WAN Manager (vManage) CVEs from internal testing. One of them is CVE-2026-20122. Because of improper file handling in the API, an attacker with read-only API credentials can upload a file that overwrites arbitrary files and gains vmanage user privileges. Cisco's advisory scores it CVSS 3.1 7.1. The CVE record and NVD list 5.4.

The credential requirement turned out to be thin protection. On March 3, GitHub user zerozenxlabs posted a proof of concept labeled as CVE-2026-20127. VulnCheck showed it actually chains CVE-2026-20133 and CVE-2026-20128 to obtain Data Collection Agent credentials, then uses CVE-2026-20122 to upload a webshell. Cisco confirmed exploitation of -20122 and -20128 on March 5, and of -20133 in April. CISA added all three to KEV on April 20, 2026, with a three-day deadline.

Cisco Talos later described exploitation "from March to April 2026" across 10 activity clusters, separate from UAT-8616. Most used the public PoC and its JSP webshell, which Talos calls XenShell. Follow-on payloads included Godzilla and Behinder webshells, Sliver and AdaptixC2 implants, gsocket tunnels, XMRig miners, and a script that tried to pull the admin hash, JWT key material and the Manager's AWS credentials.

Who is affected#

SD-WAN Manager in any configuration. Fixed releases are 20.9.8.2, 20.12.5.3 or 20.12.6.1, 20.15.4.2 and 20.18.2.1. 20.10 and 20.11 move to 20.12.6.1, 20.13 and 20.14 to 20.15.4.2, 20.16 to 20.18.2.1, and anything before 20.9 must migrate. There is no workaround. VulnCheck counted roughly 450 to 550 Managers visible on Shodan and Censys in March.

Do you really need to act?#

If you patched for CVE-2026-20127 in late February, you installed these fixes too, because the first fixed builds are the same. The upgrade for CVE-2026-76504 (September 2026) moves you further along the same trains. What remains is the window. Any Manager that was unpatched and reachable after March 3 faced a public, working chain used across at least ten distinct activity clusters. One of them harvested credentials that stay valid after a patch.

What to do now#

  1. Confirm the release on every Manager with show version, and upgrade if you are below a fixed build.
  2. From vshell, run zgrep -h 'smartLicensing/uploadAck\|cmd.gz' /var/log/nms/containers/service-proxy/serviceproxy-access.log* and zgrep -h 'wildfly/standalone/deployments' /var/log/nms/vmanage-server.log*.
  3. Run ls -la /var/lib/wildfly/standalone/deployments/ and question every WAR or JSP you did not put there.
  4. If anything turns up, run request admin-tech, open a TAC case and rebuild the fabric per Cisco's guidance. Rotate admin, API and DCA credentials, JWT signing keys and any AWS keys the Manager held.
  5. Keep the Manager's web UI and API off the internet and limited to management networks.

How to tell if you were hit#

Cisco's indicators are in /var/log/nms/containers/service-proxy/serviceproxy-access.log. Look for POSTs to /dataservice/smartLicensing/uploadAck from IPs other than your licensing administrators, GETs for .../data-collection-agent/.dca, and any request to /cmd.gz/cmd.jsp, an endpoint that exists only after the PoC runs. In vmanage-server.log, look for file names with ../../ pointing into /var/lib/wildfly/standalone/deployments/. Talos adds webshell names (sysv.jsp, sysinit.jsp, conf.jsp, vmurnp_ikp.jsp), /tmp/moneroocean/, loot_run.sh and Snort SIDs 66461-66462 for this CVE.

Timeline#

  • — Cisco discloses CVE-2026-20122 with fixes.
  • — zerozenxlabs PoC posted (mislabeled as CVE-2026-20127).
  • — Cisco confirms exploitation of CVE-2026-20122 and -20128.
  • — Cisco adds indicators of compromise.
  • — CISA adds -20122, -20128, -20133 to KEV (due Apr 23).
  • — Talos publishes 10 exploitation clusters.

Vulnerability records

  • CVE-2026-20122 · KEV 2026-04-20 · A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Cisco — Cisco Catalyst SD-WAN Vulnerabilities (cisco-sa-sdwan-authbp-qwCX8D4v) sec.cloudapps.cisco.com
  2. CVE record — CVE-2026-20122 cve.org
  3. NVD — CVE-2026-20122 nvd.nist.gov
  4. CISA — Known Exploited Vulnerabilities: CVE-2026-20122 cisa.gov
  5. CISA — CISA Adds Eight Known Exploited Vulnerabilities to Catalog (Apr 20, 2026) cisa.gov
  6. CISA — ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems cisa.gov
  7. Cisco Talos — Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities blog.talosintelligence.com
  8. VulnCheck — Herding Cats: Recent Cisco SD-WAN Manager Vulnerabilities vulncheck.com

Coverage and analysis

  1. The Hacker News — Cisco Confirms Active Exploitation of Two Catalyst SD-WAN Manager Vulnerabilities thehackernews.com