Cisco Warns of Actively Exploited Zero-Day (CVE-2026-20245) in Catalyst SD-WAN Manager
Cisco Catalyst SD-WAN Zero-Day Flaw Actively Exploited for Root Access
Related Entities(initial)
Organizations
Products & Tech
CVE Identifiers
Full Report(when first published)
Executive Summary
Cisco has issued a security advisory for a critical zero-day vulnerability, CVE-2026-20245, affecting its Cisco Catalyst SD-WAN Manager product. The vulnerability is a command injection flaw with a CVSS score of 7.8 and is confirmed to be under active, albeit limited, exploitation. A remote attacker who has already gained administrative (netadmin) privileges on a target system can exploit this flaw by uploading a specially crafted file to the CLI. Successful exploitation allows the attacker to execute arbitrary commands on the underlying operating system with root privileges. The vulnerability, reported by Mandiant, affects all deployment models, including on-premise and cloud-hosted versions. At the time of disclosure, no patches were available.
Vulnerability Details
The vulnerability, CVE-2026-20245, stems from insufficient input validation within the command-line interface (CLI) of the Cisco Catalyst SD-WAN Manager. An attacker with netadmin privileges can craft a file and upload it via the CLI. The system fails to properly sanitize the input from this file, allowing the attacker to inject and execute arbitrary shell commands.
- CVE ID: CVE-2026-20245
- CVSS Score: 7.8 (High)
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Attack Vector: Remote, requires high privileges (
netadmin). - Impact: Arbitrary command execution as
root.
An attacker must first be authenticated as a high-privileged user. This could be achieved through stolen credentials or by chaining this vulnerability with a prior authentication bypass flaw, such as CVE-2026-20182. This marks the seventh zero-day vulnerability disclosed by Cisco for its SD-WAN products in 2026, indicating a sustained targeting of this technology by threat actors.
Affected Systems
The vulnerability impacts all deployment types of Cisco Catalyst SD-WAN Manager. This includes:
- On-premise deployments
- Cloud-Pro
- Cisco Managed Cloud
- FedRAMP environments
Administrators should consult the official Cisco security advisory for a complete list of affected software versions. As of the initial disclosure, no patched versions are available.
Exploitation Status
Cisco has confirmed that it is aware of "a limited number of instances" where CVE-2026-20245 has been actively exploited in the wild. The observed exploitation resulted in attackers pushing unauthorized configuration changes to managed edge devices. The fact that it is being exploited in the wild, even if limited, significantly raises the urgency for mitigation. The vulnerability was responsibly disclosed by researchers at Mandiant.
Impact Assessment
The impact of exploiting CVE-2026-20245 is severe. Gaining root access on the SD-WAN Manager grants an attacker complete control over the network's orchestration layer. From this position, an attacker can:
- Modify Network Configurations: Reroute traffic, create backdoors, or cause widespread network outages.
- Intercept Traffic: Decrypt and monitor sensitive data flowing through the SD-WAN fabric.
- Lateral Movement: Use the SD-WAN Manager as a pivot point to attack other connected devices and segments of the corporate network.
- Deploy Malware: Push malicious software or configurations to all managed edge devices.
Given that SD-WAN is central to modern enterprise networking, a compromise of the manager component can undermine the security and availability of the entire organization's WAN.
Cyber Observables — Hunting Hints
The following patterns may help identify vulnerable or compromised systems:
/bin/sh, bash) being executed by the application's user context, which is not typical behavior.Detection Methods
Organizations should focus on detecting both exploitation attempts and post-compromise activity.
Log Analysis: Forward all administrative and system logs from Cisco Catalyst SD-WAN Manager to a central SIEM. Create alerting rules for:
- Multiple failed login attempts followed by a success for a
netadminaccount. - File uploads via the CLI outside of normal maintenance windows.
- Any configuration changes pushed to edge devices that are not documented in change management systems. This leverages the D3FEND technique Authentication Event Thresholding.
- Multiple failed login attempts followed by a success for a
Network Monitoring: Implement Network Traffic Analysis on traffic to and from the SD-WAN Manager's management interface. Baseline normal traffic patterns and alert on anomalies, such as connections from unknown IP ranges or data exfiltration patterns.
Integrity Monitoring: Use file integrity monitoring on the SD-WAN Manager appliance to detect unauthorized changes to system files or the creation of suspicious scripts in executable directories.
Remediation Steps
As there is no patch available at the time of writing, mitigation is critical.
- Apply Previous Patches: Cisco's primary recommendation is to upgrade to a software version that addresses
CVE-2026-20182(an authentication bypass). While this does not fix CVE-2026-20245, it makes it much harder for an unauthenticated attacker to gain the necessary privileges to exploit it. This is a form of D3FEND's Software Update. - Restrict Access: Strictly limit access to the SD-WAN Manager's management interface. Use a firewall or access control lists (ACLs) to ensure it is only reachable from a secure management network or specific administrative jump hosts. This is a key principle of Network Isolation.
- Privileged Access Management: Tightly control and monitor all accounts with
netadminprivileges. Implement Multi-factor Authentication for all administrative access. - Monitor for Updates: Continuously monitor for the release of a patch from Cisco and apply it as soon as it becomes available.
Timeline of Events
Article Updates
June 7, 2026
New reports confirm ongoing active exploitation of Cisco SD-WAN zero-day (CVE-2026-20245), emphasizing the lack of official patches or workarounds and clarifying the need for authenticated local access.
New reports from June 7, 2026, reinforce the critical nature of CVE-2026-20245, a high-severity zero-day in Cisco Catalyst SD-WAN Manager. The vulnerability continues to be actively exploited in the wild, allowing an authenticated local attacker to achieve root privileges. Critically, Cisco has not yet released any security patch or official workaround, leaving organizations exposed. The advisory reiterates the broad impact across all deployment models and highlights the ongoing threat posed by this seventh SD-WAN zero-day in 2026. Mitigation efforts remain focused on strictly limiting access and enhanced monitoring.
Update Sources:
June 25, 2026
Severity increasedMandiant reveals Cisco SD-WAN zero-day (CVE-2026-20245) was exploited for months before disclosure, targeting a communications service provider and creating a rogue root account.
New details from Mandiant reveal the Cisco Catalyst SD-WAN zero-day (CVE-2026-20245) was actively exploited for at least two months prior to its public disclosure on June 4, 2026. The attacks targeted a communications service provider, where threat actors gained root access by uploading a malicious CSV file ('evil_tenant.csv') via the CLI. They established persistence by creating a rogue root-level user account named 'troot' and used anti-forensic methods to cover their tracks. This significantly escalates the perceived threat and impact of the vulnerability.
Update Sources:
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.