❌

Visualização de leitura

↗️

CVE-2026-20245 Zero-Day Exploited in Cisco Catalyst SD-WAN Manager to Gain Root Access

✇Firewall Daily – The Cyber Express
Por:Ashish Khaitan

CVE-2026-20245

A newly disclosed zero-day vulnerability, CVE-2026-20245, has been exploited by a threat actor targeting Cisco Catalyst SD-WAN Manager. By exploiting a flaw in the platform's file to upload functionality, the threat actor escalated privileges from a compromised administrative account to root access and used extensive anti-forensic measures to erase evidence of the attack. 

Threat Actor Abused Cisco Catalyst SD-WAN Manager to Gain Root Access 

Mandiant found that the threat actor initially established unauthorized peering connections before accessing Cisco Catalyst SD-WAN Manager over SSH. In March 2026, the attacker authenticated using the default vmanage-admin account, changed the default admin account password, logged into the web interface, and exfiltrated SD-WAN fabric configurations, including device, controller, and template information.   The original password was then restored to reduce the likelihood of detection. The researchers noted that neither the vmanage-admin nor admin accounts provide root shell access, prompting the attacker to exploit CVE-2026-20245 for privilege escalation. 

CVE-2026-20245 was Exploited Through a Malicious CSV Upload 

The vulnerability exists because Cisco Catalyst SD-WAN Manager fails to properly filter malicious data uploaded through its tenant file upload feature. The threat actor exploited CVE-2026-20245 by uploading a crafted file named evil_tenant.csv using the command: 
request tenant-upload tenant-list /home/admin/evil_tenant.csv vpn 0 
Reported to Cisco by Mandiant, CVE-2026-20245 affects the command-line interface of Cisco Catalyst SD-WAN Controllers and allows an authenticated local attacker to execute arbitrary commands as root through a specially crafted file.  The malicious payload backed up configuration files, preserved copies of /etc/passwd and /etc/shadow, and created a new root-level account named troot. Mandiant later observed the threat actor switching from the admin account to troot using the su command.

Rogue Peering Activity Preceded Exploitation 

Mandiant observed multiple unauthorized peering connections between late 2025 and January 2026. Researchers believe these may have exploited CVE-2026-20127 or CVE-2026-20182, two critical Cisco vulnerabilities affecting peering authentication that allow remote attackers to bypass authentication and gain administrative privileges.  Further rogue peering activity in March 2026 targeted software versions not vulnerable to CVE-2026-20127. Cisco confirmed the activity also did not rely on CVE-2026-20182, suggesting the threat actor may have reused stolen certificate material from an earlier compromise. Mandiant said it remains unclear whether the same group conducted both campaigns.  To conceal the intrusion, the threat actor deleted evil_tenant.csv, restored modified configuration files, removed temporary artifacts, and executed a validation script to confirm that malicious files, the troot account, and altered configuration files had been removed or restored.

Implications and Mitigation 

Mandiant said the campaign reflects the growing "living off the edge" trend, where attackers target network appliances that often lack detailed forensic visibility while providing centralized control over enterprise environments. Such platforms remain attractive to state-sponsored actors seeking long-term intelligence collection.  Organizations are advised to collect diagnostic logs using the request admin-tech command, investigate any indicators of compromise, and report confirmed incidents to Cisco TAC. Cisco recommends upgrading Cisco Catalyst SD-WAN Manager to versions 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, 26.1.1.2, or later to remediate CVE-2026-20245 and following its SD-WAN hardening guidance.  Recovered indicators include the malicious evil_tenant.csv file with SHA-256 hash b82936f37648518425c7d3cf9e09eaffa41d7cdb3840f6a40287e3a108880f7b and rogue IP addresses including 126.51.108[.]152, 76.92.245[.]217, 207.190.37[.]94, 23.245.7[.]178, 153.186.231[.]233, 167.179.79[.]189, 45.32.38[.]160, and 209.137.225[.]101.   Google SecOps also released detections covering behaviors associated with the threat actor, while Mandiant acknowledged Cisco PSIRT for its collaboration during the coordinated disclosure process. 
↗️

Cisco Warns of Active Exploitation of Catalyst SD-WAN Flaw With No Patch Available

✇Firewall Daily – The Cyber Express
Por:Ashish Khaitan

CVE-2026-20245

Cisco has issued an urgent warning that a high-severity vulnerability in its Catalyst SD-WAN Manager platform is being actively exploited in the wild—and no patch exists yet. CVE-2026-20245 allows authenticated attackers with netadmin privileges to execute arbitrary commands as root, placing wide-area network infrastructure at severe risk.
The disclosure is particularly alarming because Catalyst SD-WAN Manager controls and orchestrates SD-WAN deployments across enterprise and carrier networks. A successful exploit could allow attackers to push malicious configurations to thousands of edge devices simultaneously.

Understanding CVE-2026-20245

CVE-2026-20245 exists in the command-line interface (CLI) of Cisco Catalyst SD-WAN Manager, resulting from insufficient validation of user-supplied input when processing file arguments. The vulnerability carries a CVSS base score of 7.8 (High), with a vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
To exploit the flaw, an attacker must have netadmin-level credentials on the affected system. While this limits the immediate attack surface, Cisco noted in its advisory that attackers are chaining CVE-2026-20245 with two related vulnerabilities—CVE-2026-20182 and CVE-2026-20127—to achieve initial access before escalating to root execution. This chaining technique effectively reduces the privilege prerequisite in practice.
An attacker supplies a specially crafted file to the Catalyst SD-WAN Manager CLI. Insufficient input validation allows the crafted file to execute arbitrary OS-level commands with root privileges. Cisco confirmed "limited cases" in which exploitation resulted in configuration changes being pushed to downstream edge devices—a significant escalation of potential impact.

No Patch Available — Cisco Plans Future Release

Unlike most critical vulnerability advisories, Cisco has disclosed CVE-2026-20245 without an accompanying patch. The company stated it plans to address the vulnerability in a future software release but did not provide a specific timeline.
This leaves organisations with only partial mitigations at their disposal. Cisco advises restricting CLI access to only trusted users and applying strict controls on file upload functionality within SD-WAN Manager administrative interfaces.
A vulnerability without a patch and with confirmed in-the-wild exploitation is a worst-case scenario for network defenders," noted a network security practitioner familiar with SD-WAN infrastructure. Every day without a patch is another day of active risk.

Why It Matters

SD-WAN infrastructure occupies a privileged position in modern enterprise networks, providing policy control over traffic routing across branches, data centres, and cloud environments. Compromising the management plane—which CVE-2026-20245 enables—gives attackers visibility into traffic flows, the ability to redirect connectivity, and the power to inject backdoor configurations across all managed edges.
The impact extends beyond a single organisation. Managed service providers (MSPs) and telecommunications carriers that use Cisco Catalyst SD-WAN to manage multiple customer environments face the prospect of cross-tenant compromise if their management platform is breached.

Mitigation Steps

  • Immediately audit who holds netadmin credentials on Catalyst SD-WAN Manager deployments and revoke unnecessary access.
  • Enable multi-factor authentication (MFA) for all SD-WAN Manager administrative accounts to reduce credential-theft risk.
  • Restrict file upload functionality within the SD-WAN Manager interface to the absolute minimum required for operations.
  • Monitor SD-WAN Manager CLI logs for unusual file upload activity or unexpected root-level command executions.
  • Apply network segmentation to isolate the SD-WAN management plane from general enterprise networks.
  • Subscribe to Cisco Security Advisories (tools.cisco.com/security/center) and apply the patch immediately upon release.
  • Conduct a configuration audit of all managed edge devices to identify any unauthorized configuration pushes already applied.
❌