Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Actively Exploited for Root Access and Management Plane Compromise

Executive Summary

CVE-2026-20245 is a critical zero-day vulnerability affecting Cisco Catalyst SD-WAN components, specifically SD-WAN Manager (vManage), SD-WAN Controller (vSmart), and SD-WAN Validator (vBond). This flaw enables an authenticated attacker with netadmin privileges to execute arbitrary commands as the root user by uploading a maliciously crafted file, resulting in full system compromise. The vulnerability has been actively exploited in the wild, with attackers leveraging it to push unauthorized configuration changes to edge devices, potentially impacting the integrity and availability of entire SD-WAN infrastructures. The issue was discovered and reported by Mandiant (Google Cloud) and publicly disclosed by Cisco in June 2026. Immediate action is required to mitigate the risk, as no workarounds exist and exploitation has been confirmed.

Threat Actor Profile

The exploitation of CVE-2026-20245 has not been attributed to a specific Advanced Persistent Threat (APT) group as of June 2026. However, the attack methodology demonstrates a high level of sophistication, with adversaries chaining this vulnerability with other SD-WAN flaws such as CVE-2026-20182 and CVE-2026-20127 to escalate privileges and gain initial access. The attackers are capable of credential theft, lateral movement, and leveraging valid accounts to bypass traditional security controls. The threat actors’ primary objective appears to be the compromise of the SD-WAN management plane, enabling them to manipulate network configurations and potentially disrupt or surveil enterprise communications. The lack of public proof-of-concept (PoC) code suggests that exploitation is currently limited to well-resourced and technically adept adversaries, likely operating with targeted objectives rather than broad opportunistic campaigns.

Technical Analysis of Malware/TTPs

CVE-2026-20245 is rooted in improper input validation within the command-line interface (CLI) of affected Cisco Catalyst SD-WAN components. The vulnerability is classified under CWE-116 (Improper Encoding or Escaping of Output). An attacker with netadmin privileges can upload a specially crafted file through the CLI workflow. This file is processed by backend scripts without adequate sanitization, allowing for command injection and subsequent execution of arbitrary commands as the root user.

The typical attack chain involves the following steps: The adversary first acquires netadmin credentials, either through credential theft or by exploiting other vulnerabilities such as CVE-2026-20182 or CVE-2026-20127. With these elevated privileges, the attacker uploads a malicious file using the CLI, which triggers the vulnerable script. The script executes the embedded payload with root privileges, granting the attacker full control over the SD-WAN management plane. In observed incidents, attackers have used this access to push unauthorized configuration changes to edge devices, potentially enabling further lateral movement, data exfiltration, or disruption of network services.

Key technical indicators include suspicious entries in /var/log/scripts.log, such as invocations of /usr/bin/vconfd_script_upload_tenant_list.sh, /usr/bin/vconfd_script_upload_vsmart_serial_numbers.sh, and /usr/bin/vconfd_script_upload_chassis_number_file.sh with unusual file paths or parameters. These scripts are legitimate components of the SD-WAN management workflow, but their misuse for malicious uploads is a hallmark of this exploit.

The exploitation aligns with several MITRE ATT&CK techniques: T1059.004 (Command and Scripting Interpreter: Unix Shell), T1078 (Valid Accounts), T1546.003 (Event Triggered Execution: Unix Shell Configuration Modification), and T1562.001 (Impair Defenses: Disable or Modify Tools). The attack complexity is low once the attacker has obtained the necessary privileges, and no user interaction is required beyond the initial credential compromise.

Exploitation in the Wild

Active exploitation of CVE-2026-20245 was first reported in June 2026 by Cisco PSIRT and Mandiant. Incidents have been observed where attackers, after obtaining netadmin access, executed root-level commands and pushed unauthorized configuration changes to SD-WAN edge devices. There is no evidence of exploitation without prior acquisition of valid netadmin credentials, underscoring the importance of credential hygiene and monitoring for privilege escalation.

No public PoC was available at the time of disclosure, but both Cisco and Mandiant have confirmed exploitation in real-world environments. The attacks have targeted organizations across various sectors, with a focus on those operating internet-exposed SD-WAN management interfaces. The observed impact includes unauthorized changes to network configurations, potential disruption of business operations, and the risk of further compromise of connected infrastructure.

Victimology and Targeting

As of June 2026, there is no public attribution of CVE-2026-20245 exploitation to a specific APT group or nation-state actor. However, related SD-WAN vulnerabilities, such as CVE-2026-20127, have been linked to threat activity cluster UAT-8616. The targeting appears to be broad, affecting all organizations utilizing Cisco Catalyst SD-WAN solutions, regardless of sector or geography. Both on-premises and cloud-managed deployments, including FedRAMP-certified environments, are at risk. Organizations with internet-exposed SD-WAN management interfaces are particularly vulnerable, as these provide a larger attack surface for credential theft and privilege escalation.

The lack of sector-specific targeting suggests that the primary motivation is likely access to high-value network infrastructure rather than industry-specific espionage or sabotage. However, the potential for downstream impact on critical infrastructure, government networks, and large enterprises cannot be understated.

Mitigation and Countermeasures

There are currently no workarounds for CVE-2026-20245. The only effective mitigation is to upgrade affected systems to the fixed software versions provided by Cisco. The following releases contain the necessary patches: 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, and 26.1.1.2. Organizations running any version prior to these should prioritize immediate upgrade to prevent exploitation.

Before upgrading, it is critical to preserve forensic evidence by running the request admin-tech command on all control components and retaining all relevant logs for post-upgrade investigation. This step is essential, as upgrading alone does not remove an active compromise. If indicators of compromise are detected, organizations should contact Cisco TAC for tailored remediation guidance.

Additional countermeasures include enforcing strong credential management practices, monitoring for suspicious activity in /var/log/scripts.log, restricting access to SD-WAN management interfaces, and implementing network segmentation to limit the blast radius of a potential breach. Regular review of privileged accounts and multi-factor authentication for administrative access are also recommended.

References

About Rescana

Rescana is a leader in third-party risk management (TPRM), providing organizations with a comprehensive platform to continuously monitor, assess, and mitigate cyber risks across their extended supply chain. Our advanced analytics and threat intelligence capabilities empower security teams to proactively identify vulnerabilities, prioritize remediation, and ensure compliance with industry standards. For more information about how Rescana can help strengthen your organization’s cyber resilience, or if you have any questions regarding this advisory, please contact us at info@rescana.com.