LiveThreat Vulnerability Brief — CVE-2026-20122
What It Is — Cisco Catalyst SD‑WAN Manager (formerly SD‑WAN vManage) contains an arbitrary file‑overwrite flaw that lets an authenticated remote attacker replace any file on the appliance’s filesystem. Exploitability — CVSS 7.1; Cisco confirms active exploitation in the wild with observable proof‑of‑concept traffic. Affected Products — Cisco Catalyst SD‑WAN Manager across all supported releases. TPRM Impact — A compromised SD‑WAN controller can cascade to every branch site and to any third‑party MSP customers, creating a broad supply‑chain risk and potential data exposure. Recommended Actions — Apply Cisco’s patch immediately, enforce MFA and strong passwords for all management accounts, restrict management‑plane access to trusted networks/VPNs, enable file‑integrity monitoring, and inventory all deployed instances to verify remediation. Source: The Hacker News