SAN JOSE, CALIF. — Cisco has released emergency security updates to patch CVE-2026-20262, a critical zero-day vulnerability in its Catalyst SD-WAN Manager that is currently being actively exploited in the wild www.securityweek.com . Think of this vulnerability like a master key that allows attackers to not just enter a building, but to write their own rules on the walls—literally allowing them to plant malicious files anywhere on the system.

The flaw allows unauthenticated attackers to perform arbitrary file writes, which can then be leveraged to escalate privileges to root level, giving them complete control over the affected SD-WAN infrastructure thehackernews.com . This is particularly dangerous because SD-WAN managers are the brain of enterprise networks, controlling traffic flow between branch offices, data centers, and cloud services.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, indicating that federal agencies and critical infrastructure operators must patch immediately securityaffairs.com .

Cisco became aware of the exploitation only after attackers had already begun targeting vulnerable systems in the wild www.securityweek.com . The company has released patches for affected versions and urges all customers to update immediately. Security teams should also monitor their networks for any signs of compromise, as the arbitrary file write capability means attackers could have planted persistent backdoors before the vulnerability was discovered.