---
title: "Cisco SD-WAN Manager CVE-2026-20122: Webshell File Overwrite"
url: https://erroneo.us/security/briefs/cisco-sd-wan-manager-cve-2026-20122-api-file-overwrite/
description: "SD-WAN Manager API file overwrite, chained by a public PoC to plant webshells in Mar-Apr 2026. Fixed in 20.9.8.2, 20.12.6.1, 20.15.4.2, 20.18.2.1. Hunt."
type: security-brief
section: "Security Digest"
date_published: 2026-02-25
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-20122"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Cisco SD-WAN Manager CVE-2026-20122: Webshell File Overwrite

**Verdict: Check exposure.** Fixed since February and mass-exploited with a public PoC in March and April 2026: confirm every SD-WAN Manager is on a fixed release, then hunt for the upload and webshell traces Cisco and Talos describe.

- **Who must act:** Anyone running on-prem or self-managed Catalyst SD-WAN Manager that was below a fixed release at any point after early March 2026, especially with the web UI or API reachable from untrusted networks.
- **Who can relax:** Organizations without Catalyst SD-WAN, and Manager instances patched before March 2026 whose web and API interfaces were never exposed beyond a management network.
- **Affected:** SD-WAN Manager releases earlier than 20.9 (migrate); 20.9 before 20.9.8.2; 20.10 and 20.11 (move to 20.12.6.1); 20.12 before 20.12.5.3 / 20.12.6.1; 20.13, 20.14 and 20.15 before 20.15.4.2; 20.16 and 20.18 before 20.18.2.1
- **Fixed:** 20.9.8.2; 20.12.5.3 or 20.12.6.1; 20.15.4.2; 20.18.2.1; Later releases that fix CVE-2026-76504 (e.g. 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1)
- **CVEs:** CVE-2026-20122
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every SD-WAN Manager and confirm it runs a fixed release (show version); migrate anything older than 20.9 or on 20.10/20.11/20.13/20.14/20.16.
2. Grep serviceproxy-access.log for POST /dataservice/smartLicensing/uploadAck and /cmd.gz/cmd.jsp, and vmanage-server.log for ../ paths into the WildFly deployments folder.
3. List /var/lib/wildfly/standalone/deployments/ and investigate any WAR or JSP you did not deploy.
4. If you find traces, collect request admin-tech output, open a TAC case and rebuild per Cisco's fabric rebuild guidance rather than cleaning in place.
5. Restrict Manager web UI and API to management networks, and rotate admin, read-only API and DCA credentials plus any cloud keys stored on the Manager.

### How to check if you are affected

- POST /dataservice/smartLicensing/uploadAck in /var/log/nms/containers/service-proxy/serviceproxy-access.log from IPs that are not your licensing admins.
- vmanage-server.log entries writing ../../var/lib/wildfly/standalone/deployments/<name>.war, and any request to /cmd.gz/cmd.jsp.
- Requests for /reports/data/opt/data/containers/config/data-collection-agent/.dca (the CVE-2026-20128 step of the chain).
- Talos webshell names (sysv.jsp, sysinit.jsp, conf.jsp, vmurnp_ikp.jsp, 20251117022131.jsp), XMRig or /tmp/moneroocean, gsocket, Sliver or AdaptixC2 implants, and loot_run.sh.

## What happened

On February 25, 2026, the same day as the CVE-2026-20127 peering bypass and [ED 26-03](https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems) (covered in our February 25 brief), Cisco published a [second advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v) with five SD-WAN Manager (vManage) CVEs from internal testing. One of them is [CVE-2026-20122](https://www.cve.org/CVERecord?id=CVE-2026-20122). Because of improper file handling in the API, an attacker with read-only API credentials can upload a file that overwrites arbitrary files and gains `vmanage` user privileges. Cisco's advisory scores it CVSS 3.1 7.1. The CVE record and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-20122) list 5.4.

The credential requirement turned out to be thin protection. On March 3, GitHub user zerozenxlabs posted a proof of concept labeled as CVE-2026-20127. [VulnCheck](https://www.vulncheck.com/blog/cisco-sd-wan-manager-vulns) showed it actually chains CVE-2026-20133 and CVE-2026-20128 to obtain Data Collection Agent credentials, then uses CVE-2026-20122 to upload a webshell. Cisco [confirmed exploitation](https://thehackernews.com/2026/03/cisco-confirms-active-exploitation-of.html) of -20122 and -20128 on March 5, and of -20133 in April. CISA added all three to KEV on [April 20, 2026](https://www.cisa.gov/news-events/alerts/2026/04/20/cisa-adds-eight-known-exploited-vulnerabilities-catalog), with a three-day deadline.

[Cisco Talos](https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/) later described exploitation "from March to April 2026" across 10 activity clusters, separate from UAT-8616. Most used the public PoC and its JSP webshell, which Talos calls XenShell. Follow-on payloads included Godzilla and Behinder webshells, Sliver and AdaptixC2 implants, gsocket tunnels, XMRig miners, and a script that tried to pull the admin hash, JWT key material and the Manager's AWS credentials.

## Who is affected

SD-WAN Manager in any configuration. Fixed releases are 20.9.8.2, 20.12.5.3 or 20.12.6.1, 20.15.4.2 and 20.18.2.1. 20.10 and 20.11 move to 20.12.6.1, 20.13 and 20.14 to 20.15.4.2, 20.16 to 20.18.2.1, and anything before 20.9 must migrate. There is no workaround. VulnCheck counted roughly 450 to 550 Managers visible on Shodan and Censys in March.

## Do you really need to act?

If you patched for CVE-2026-20127 in late February, you installed these fixes too, because the first fixed builds are the same. The upgrade for CVE-2026-76504 (September 2026) moves you further along the same trains. What remains is the window. Any Manager that was unpatched and reachable after March 3 faced a public, working chain used across at least ten distinct activity clusters. One of them harvested credentials that stay valid after a patch.

## What to do now

1. Confirm the release on every Manager with `show version`, and upgrade if you are below a fixed build.
2. From `vshell`, run `zgrep -h 'smartLicensing/uploadAck\|cmd.gz' /var/log/nms/containers/service-proxy/serviceproxy-access.log*` and `zgrep -h 'wildfly/standalone/deployments' /var/log/nms/vmanage-server.log*`.
3. Run `ls -la /var/lib/wildfly/standalone/deployments/` and question every WAR or JSP you did not put there.
4. If anything turns up, run `request admin-tech`, open a TAC case and rebuild the fabric per Cisco's guidance. Rotate admin, API and DCA credentials, JWT signing keys and any AWS keys the Manager held.
5. Keep the Manager's web UI and API off the internet and limited to management networks.

## How to tell if you were hit

Cisco's indicators are in `/var/log/nms/containers/service-proxy/serviceproxy-access.log`. Look for POSTs to `/dataservice/smartLicensing/uploadAck` from IPs other than your licensing administrators, GETs for `.../data-collection-agent/.dca`, and any request to `/cmd.gz/cmd.jsp`, an endpoint that exists only after the PoC runs. In `vmanage-server.log`, look for file names with `../../` pointing into `/var/lib/wildfly/standalone/deployments/`. Talos adds webshell names (`sysv.jsp`, `sysinit.jsp`, `conf.jsp`, `vmurnp_ikp.jsp`), `/tmp/moneroocean/`, `loot_run.sh` and Snort SIDs 66461-66462 for this CVE.

## Timeline

- Feb 25, 2026 — Cisco discloses CVE-2026-20122 with fixes.
- Mar 3, 2026 — zerozenxlabs PoC posted (mislabeled as CVE-2026-20127).
- Mar 5, 2026 — Cisco confirms exploitation of CVE-2026-20122 and -20128.
- Mar 18, 2026 — Cisco adds indicators of compromise.
- Apr 20, 2026 — CISA adds -20122, -20128, -20133 to KEV (due Apr 23).
- May 14, 2026 — Talos publishes 10 exploitation clusters.

## Sources

1. [Cisco — Cisco Catalyst SD-WAN Vulnerabilities (cisco-sa-sdwan-authbp-qwCX8D4v)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v)
2. [CVE record — CVE-2026-20122](https://www.cve.org/CVERecord?id=CVE-2026-20122)
3. [NVD — CVE-2026-20122](https://nvd.nist.gov/vuln/detail/CVE-2026-20122)
4. [CISA — Known Exploited Vulnerabilities: CVE-2026-20122](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20122)
5. [CISA — CISA Adds Eight Known Exploited Vulnerabilities to Catalog (Apr 20, 2026)](https://www.cisa.gov/news-events/alerts/2026/04/20/cisa-adds-eight-known-exploited-vulnerabilities-catalog)
6. [CISA — ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems](https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems)
7. [Cisco Talos — Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities](https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/)
8. [VulnCheck — Herding Cats: Recent Cisco SD-WAN Manager Vulnerabilities](https://www.vulncheck.com/blog/cisco-sd-wan-manager-vulns)
9. [The Hacker News — Cisco Confirms Active Exploitation of Two Catalyst SD-WAN Manager Vulnerabilities](https://thehackernews.com/2026/03/cisco-confirms-active-exploitation-of.html)

---
Source page: https://erroneo.us/security/briefs/cisco-sd-wan-manager-cve-2026-20122-api-file-overwrite/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt