On June 4–5, 2026, Cisco disclosed CVE-2026-20245: an unpatched command injection zero-day in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) that allows authenticated local attackers with netadmin privileges to execute arbitrary commands as root. Cisco confirmed active exploitation was reported by Mandiant. Limited real-world attacks resulted in unauthorized configuration changes being pushed to edge devices managed by the compromised SD-WAN Manager instances.
No patch is currently available. Cisco's Product Security Incident Response Team (PSIRT) recommends upgrading to the fixed software version documented in the CVE-2026-20182 advisory (published May 14, 2026) and immediately auditing edge device configurations. The flaw affects all deployment types: on-premises, Cisco SD-WAN Cloud-Pro, Cisco Managed, and FedRAMP.
This is the latest in a string of actively exploited Catalyst SD-WAN Manager vulnerabilities. CISA has tagged 90 Cisco vulnerabilities as exploited in the wild over recent years, with four in Catalyst SD-WAN Manager alone.
◈ Table of Contents
PHASE 01 — Vulnerability Details
CVSS 7.8 HIGH| Field | Detail |
|---|---|
| CVE ID | CVE-2026-20245 |
| CVSS Score | HIGH 7.8 — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Weakness | CWE-116 — Improper Encoding or Escaping of Output |
| Affected Product | Cisco Catalyst SD-WAN Manager (all versions; formerly SD-WAN vManage) |
| Vulnerability Type | Command injection via crafted file upload to CLI |
| Root Cause | Insufficient validation of user-supplied input in the CLI; file upload path fails to sanitize content before passing to shell |
| Privileges Required | netadmin privileges (low-privilege local user; can be obtained via CVE-2026-20182 or CVE-2026-20127) |
| Impact | Confidentiality: HIGH · Integrity: HIGH · Availability: HIGH |
| Patch Available | NO — zero-day as of June 5, 2026. Cisco advises upgrading to CVE-2026-20182 fix (May 14, 2026) |
| Exploit in Wild | YES — Mandiant reported limited exploitation; unauthorized config changes pushed to edge devices confirmed |
| NVD Published | June 4, 2026 |
| Reported By | Mandiant (Google Cloud subsidiary) |
PHASE 02 — Exploitation Details
ACTIVE IN WILDCVE-2026-20245 requires netadmin privileges on the SD-WAN Manager. This is a low privilege level in the system's role hierarchy. An attacker who has already obtained netadmin access — either through stolen credentials, or by chaining CVE-2026-20182 (authentication bypass) or CVE-2026-20127 (also exploited since 2023) — can then use CVE-2026-20245 to fully escalate to root.
- 1Obtain netadmin access: Steal valid netadmin credentials, or chain via CVE-2026-20182 (auth bypass, patched May 14) or CVE-2026-20127 (patched March 2026)
- 2Upload crafted file: Upload a specially crafted file to the SD-WAN Manager using the CLI. The file content is not properly sanitized before being passed to shell commands.
- 3Command injection triggers: Injected shell commands execute as root. The attacker now has full control of the SD-WAN Manager.
- 4Push config to edge: Using the manager's legitimate tenant configuration workflow, push malicious configuration changes to up to 6,000 managed edge devices.
Observed exploitation resulted in configuration changes pushed to edge devices via legitimate tenant config upload to vSmart controllers. This means attackers can silently modify routing, VPN tunnels, or security policies on ALL managed devices from a single compromised manager.
Formerly known as vManage, Cisco Catalyst SD-WAN Manager is the single-pane-of-glass management platform for enterprise SD-WAN deployments. A single compromised Manager can control up to 6,000 Catalyst SD-WAN edge routers. This makes it a high-value target: owning the manager = owning the entire SD-WAN fabric.
- SD-WAN Manager is the control plane for up to 6,000 edge devices per instance
- Attacker can push configuration changes to ALL managed routers simultaneously
- No patch exists — attackers have an open window
- Chains with two already-exploited CVEs (CVE-2026-20182, CVE-2026-20127) to reduce prerequisites
- Mandiant already reported real-world exploitation — not theoretical risk
PHASE 03 — Affected Products & Versions
ALL DEPLOYMENTS| Deployment Type | Status |
|---|---|
| Cisco Catalyst SD-WAN Manager (On-Premises) | All versions — VULNERABLE |
| Cisco SD-WAN Cloud-Pro | All versions — VULNERABLE |
| Cisco SD-WAN Cloud (Cisco Managed) | All versions — VULNERABLE |
| Cisco SD-WAN for Government (FedRAMP) | All versions — VULNERABLE |
| Related CVEs in Same Platform | CVE-2026-20182 (auth bypass, patched May 14) · CVE-2026-20127 (auth bypass, patched March) · CVE-2026-20133 (info disclosure, patched Feb) · CVE-2026-20128, CVE-2026-20122 |
No fixed version is available for CVE-2026-20245 as of June 5, 2026. Cisco recommends upgrading to the software version fixed for CVE-2026-20182 (May 14 advisory) as the closest available mitigation.
PHASE 04 — IOCs & Log Investigation
CONFIRMED BY CISCOCisco confirmed that exploitation of CVE-2026-20245 leaves evidence in the SD-WAN Manager's /var/log/scripts.log file. Specifically, look for attempts to upload tenant configuration data to vSmart controllers in a manner that escalates privileges using legitimate tenant configuration commands.
PHASE 05 — MITRE ATT&CK Mapping
ENTERPRISE| Technique | ID | Notes |
|---|---|---|
| Exploitation for Privilege Escalation | T1068 | Core technique — command injection → root |
| Valid Accounts: Local Accounts | T1078.003 | netadmin credential required to trigger |
| Modify System Image | T1601 | Configuration changes pushed to managed edge devices |
| Network Device Configuration Dump | T1602 | Full SD-WAN fabric config accessible after root |
| Command and Control: Non-Standard Port | T1571 | SD-WAN management traffic on NETCONF/RESTCONF ports |
| Defense Evasion: Impair Defenses | T1562 | Root access enables disabling of logging and monitoring |
PHASE 06 — Detection & Hunt Queries
KQL / BASHUntil a patch is released, restrict who holds netadmin privileges to an absolute minimum. Remove all unnecessary netadmin accounts. Enable multi-factor authentication where supported. Segment SD-WAN Manager management traffic so it is not reachable from internet-exposed subnets.
PHASE 07 — Mitigation & Hardening
NO PATCH AVAILABLE- 1Upgrade for related CVEs: Install the May 14, 2026 release that patches CVE-2026-20182 and CVE-2026-20127. This removes two of the three ways an attacker reaches netadmin privileges needed for CVE-2026-20245.
- 2Audit scripts.log: Check
/var/log/scripts.logfor anomalous tenant config uploads to vSmart controllers. Open a Cisco TAC case if suspicious entries are found. - 3Verify edge device configs: For each managed edge device, validate the running configuration matches your expected baseline. Unauthorized config changes are the confirmed exploitation artifact.
- 4Minimize netadmin accounts: Remove all unnecessary accounts with netadmin privileges. Rotate credentials for all existing netadmin users.
- 5Isolate management plane: Ensure SD-WAN Manager is not internet-accessible. Restrict management access to jump hosts on dedicated out-of-band networks.
- 6Collect admin-tech: If compromise is suspected, collect admin-tech files per Cisco guidance before making changes:
https://cisco.com/c/en/us/support/docs/routers/sd-wan/225842
PHASE 08 — Sources
PRIMARYCheck your SD-WAN Manager exposure → Use CyberHawk's IOC Scanner to cross-reference CVE-2026-20245 indicators. If you manage Cisco SD-WAN infrastructure, contact Cisco TAC immediately if scripts.log anomalies are observed.
🔍 Launch IOC Scanner at cyberhawkthreatintel.com/ioc-scanner →
◈ Stay Connected
Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.
"They can't exploit you if you are the Exploit."