Top Highlights
- A critical vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager allows authenticated local attackers with netadmin privileges to execute arbitrary commands and gain root access, potentially leading to configuration changes across network edge devices.
- The vulnerability has been actively exploited in the wild as a zero-day, often linked to the abuse of previously reported CVEs (like CVE-2026-20127 and CVE-2026-20182), with attackers possibly deploying malicious scripts via compromised logs.
- No patches are available yet, increasing risk for internet-exposed systems; attackers may leverage this flaw to alter device configurations, with indicators of compromise detectable in specific log files, heightening the need for urgent mitigation.
Threat, Attack Techniques, and Targets
Cisco has issued a warning about a serious security vulnerability in its Catalyst SD-WAN Manager, designated as CVE-2026-20245. This flaw is actively being exploited by attackers. The vulnerability exists in the Command Line Interface (CLI) of the SD-WAN Manager. Attackers with valid network administrator privileges can exploit this flaw to execute commands as the root user. To do this, they need to upload a specially crafted file to the affected system. The attacker’s aim is to perform command injection and gain elevated privileges.
The vulnerability affects multiple deployment types, including on-premises systems, Cisco SD-WAN Cloud-Pro, Cisco SD-WAN Cloud (Managed), and Cisco SD-WAN for Government (FedRAMP). Exploitation is linked to other vulnerabilities, specifically CVE-2026-20182 and CVE-2026-20127, which have been exploited as zero-days. Threat activity has been observed since 2023, involving a cluster known as UAT-8616. The objective of attackers appears to be gaining control over affected devices by exploiting these weaknesses.
Impact, Security Implications, and Remediation Guidance
The exploitation of CVE-2026-20245 can lead to significant security issues. Attackers who succeed may perform configuration changes on edge devices and potentially control affected networks. Since the vulnerability allows command execution with root privileges, it could enable full system compromise if exploited.
However, there are no patches or fixes currently available for CVE-2026-20245. Cisco recommends customers upgrade their SD-WAN software to the latest version that addresses CVE-2026-20182, which was released on May 14, 2026. Users are also advised to monitor their systems for signs of compromise, such as unusual log entries in the “/var/log/scripts.log” file.
Because of the risk posed by internet-exposed systems, users should prioritize securing and monitoring such devices. For detailed and updated remediation guidance, users should consult the official advisories provided by Cisco or relevant security authorities.
Stay Ahead with the Latest Tech Trends
Learn how the Internet of Things (IoT) is transforming everyday life.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
