On June 5, 2026, Cisco disclosed CVE-2026-20245 — an actively exploited zero-day in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage). The flaw allows a local attacker with netadmin-level access to execute arbitrary commands as root by uploading a crafted file to the system. Mandiant, Google Cloud's cybersecurity subsidiary, discovered and reported the in-the-wild exploitation.
Cisco confirmed limited observed cases where exploitation resulted in configuration changes being pushed to downstream edge devices — meaning a compromised SD-WAN Manager can be weaponised to poison the network configuration of every device it manages. No direct patch exists for CVE-2026-20245; Cisco advises upgrading to the May 14 build that addressed related CVE-2026-20182.
This is at least the fifth Catalyst SD-WAN vulnerability under active exploitation in 2026. CISA has tagged 90 Cisco vulnerabilities as actively exploited over the past several years, four of them in SD-WAN Manager.
◈ Table of Contents
Affected Products & CVSS
PHASE 01| Field | Detail |
|---|---|
| CVE ID | CVE-2026-20245 |
| CVSS Score | 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) |
| CWE | CWE-116 (Improper encoding/escaping of output) |
| Product | Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) |
| Deployments | On-Prem, Cisco SD-WAN Cloud-Pro, Cisco SD-WAN Cloud (Cisco Managed), Cisco SD-WAN for Government (FedRAMP) |
| Published | June 4, 2026 |
| Exploitation | ACTIVELY EXPLOITED |
| Reporter | Mandiant (Google Cloud) |
| Patch status | No direct patch for CVE-2026-20245; May 14 build addresses related CVE-2026-20182 |
Exploitation Details
PHASE 02- 1Obtain netadmin credentials — via CVE-2026-20182 (max-severity auth bypass), CVE-2026-20127 (auth bypass exploited since 2023), credential theft, or legitimate insider access.
- 2Upload crafted file to SD-WAN Manager — the file exploits CWE-116 insufficient output encoding in the CLI, embedding command injection payloads in a CSV or configuration file accepted by the vConfd subsystem.
- 3CLI processes file, triggers command injection — the vconfd_script_upload_tenant_list.sh script processes the malicious file, executing attacker-controlled commands as root.
- 4Root-level code execution — attacker now has unrestricted control over the SD-WAN Manager instance, which manages up to 6,000 Catalyst SD-WAN edge devices from a single console.
- 5Push malicious config to edge devices — Cisco confirmed limited observed cases where exploitation resulted in configuration changes being pushed to edge devices across the managed network.
IOCs & Active Exploitation Evidence
PHASE 03/var/log/scripts.log for entries matching the pattern below.Cisco has observed confirmed exploitation since at least April 2026 based on log timestamps. Any SD-WAN Manager instance that has not been upgraded to the May 14 release should be considered potentially compromised — collect admin-tech files for TAC review immediately.
The Cisco SD-WAN CVE Chain
PHASE 04CVE-2026-20245 is the latest in a sustained campaign of SD-WAN Manager vulnerabilities being exploited in the wild. Attackers can chain earlier CVEs to gain initial netadmin access required to trigger CVE-2026-20245.
| CVE | Type | Status | Notes |
|---|---|---|---|
| CVE-2026-20245 | Command Injection / Root Escalation | EXPLOITED | No patch — current target |
| CVE-2026-20182 | Auth Bypass (Max Severity) | EXPLOITED | Patched May 14, 2026; can be chained to reach netadmin |
| CVE-2026-20127 | Auth Bypass (Critical) | EXPLOITED since 2023 | Patched Mar 2026 |
| CVE-2026-20133 | Information Disclosure | EXPLOITED | CISA flagged Apr 2026; patched Feb 2026 |
| CVE-2026-20128 | Undisclosed | EXPLOITED | Flagged late May 2026 |
| CVE-2026-20122 | Undisclosed | EXPLOITED | Flagged late May 2026 |
Detection & Hunting
PHASE 05Cisco recommends collecting admin-tech files before contacting TAC, as these capture the state needed to confirm compromise. Command: request admin-tech file-name /tmp/admin-tech-$(date +%Y%m%d).tar.gz
Mitigation & Patching
PHASE 06- 1Upgrade to May 14 Cisco SD-WAN release — this addresses CVE-2026-20182, eliminating the primary auth-bypass prerequisite for chaining to CVE-2026-20245.
- 2Check /var/log/scripts.log for the IOC pattern above. Any non-standard file path in the vconfd_script_upload command warrants immediate incident response.
- 3Audit edge device configurations — compare running config on all managed Catalyst SD-WAN devices against your known-good baseline to identify any malicious config pushes from the Manager.
- 4Restrict netadmin access — implement IP allowlisting for SD-WAN Manager management plane access; disable netadmin accounts not in active use.
- 5Open a case with Cisco TAC if you suspect compromise — collect admin-tech files first per Cisco's guidance at the remediation documentation URL.
MITRE ATT&CK Mapping
PHASE 07| Technique | ID | Notes |
|---|---|---|
| Valid Accounts | T1078 | Attacker requires netadmin credentials — obtained via companion auth-bypass CVEs |
| Exploitation for Privilege Escalation | T1068 | CVE-2026-20245 is the escalation vector: netadmin → root |
| Command and Scripting Interpreter | T1059 | Crafted file triggers command injection in vconfd CLI subsystem |
| Impair Defenses / Modify Network | T1562 / T1565 | Malicious config pushed to up to 6,000 edge devices via Manager |
| Ingress Tool Transfer | T1105 | Crafted CSV/config file uploaded to trigger exploit |
Sources & References
PHASE 08Scan Your Network for SD-WAN Exposure — CyberHawk's IOC Scanner can help identify network management endpoints and Cisco SD-WAN Manager instances with potential exposure. Use it alongside Cisco's admin-tech collection to triage potential compromise.
◈ Stay Connected
Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.
"They can't exploit you if you are the Exploit."