A vulnerability has been discovered in the web UI of Cisco Catalyst SD-WAN Manager that could allow an authenticated, remote attacker to create or overwrite any file on the system. This vulnerability exists due to the software's failure to properly validate user-supplied input during a file upload process. An attacker can exploit this vulnerability by sending a crafted HTTP request to the affected API endpoint. To successfully exploit the vulnerability, the attacker must have valid credentials with at least a lower-privileged user account. The attacker could use this vulnerability to create or overwrite any file on the underlying operating system, potentially using it to elevate to root access. Cisco has released software updates to address this vulnerability, but there are no available workarounds. The vulnerability is rated as medium on the security impact scale. The advisory for this vulnerability is available on Cisco's security center website. The CVE number for this vulnerability is CVE-2026-20262, and more information can be found at the provided link. The release of software updates by Cisco aims to mitigate the risk associated with this vulnerability and prevent potential attacks.