CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Cisco Catalyst SD-WAN Manager command-injection to root; Mandiant confirms pre-disclosure zero-day exploitation; patched (chains CVE-2026-20127/-20182)

cve · CVE-2026-20245

Coverage
1
first 2026-06-06 → last 2026-10-11
Latest activity
2026-06-27
An attacker with netadmin access on Cisco SD-WAN can become root through a crafted tenant file; Mandiant saw…
Peak priority
high
1 high
Targets
·
regions: switzerland
Sources cited
4
4 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-20245, newest first. Check the date before acting on an older one.

  • Upgrade every Catalyst SD-WAN Controller, Manager and Validator to its first fixed release (20.9.9.2, 20.12.7.2, 20.15.4.5 or 20.15.5.3, 20.18.3.1 or 26.1.1.2) after retaining logs, then check /etc/passwd and /etc/shadow for unexpected UID-0 accounts.
    2026-06-06CVE-2026-20245 +2

Defender insights

What each entry about CVE-2026-20245 tells a defender to do, newest first.

2026-06-06HIGHexploitedAn attacker with netadmin access on Cisco SD-WAN can become root through a crafted tenant file; Mandiant saw it used as a zero-day in April

Exposure · detection

Story timeline

  1. 2026-06-06CVE-2026-20245: Cisco Catalyst SD-WAN netadmin-to-root command injection exploited as a zero-day; fixed releases and a Live Protect shield available
    trending-vulnerabilitiesAn attacker with netadmin access on Cisco SD-WAN can become root through a crafted tenant file; Mandiant saw it used as a zero-day in April

Hunting pivots

Affected products
Cisco Catalyst SD-WAN ControllerCisco Catalyst SD-WAN ManagerCisco Catalyst SD-WAN Validator
Tags
actively-exploitedcisa-kevpatch-availablepriv-escvulnerabilities
ATT&CK techniques (4 across 4 tactics)

4 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • ExecutionCommand and Scripting Interpreter: Unix Shell
  • PersistenceCreate Account: Local Account
  • Privilege EscalationExploitation for Privilege Escalation
  • StealthIndicator Removal: File Deletion

Execution TA0002

T1059.004Command and Scripting Interpreter: Unix Shell×1

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Evidence: 2026-06-06/cve-2026-20245-cisco-catalyst-sd-wan-manager-actively-exploi · ATT&CK page ↗

Persistence TA0003

T1136.001Create Account: Local Account×1

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

Evidence: 2026-06-06/cve-2026-20245-cisco-catalyst-sd-wan-manager-actively-exploi · ATT&CK page ↗

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-06-06/cve-2026-20245-cisco-catalyst-sd-wan-manager-actively-exploi · ATT&CK page ↗

Stealth TA0005

T1070.004Indicator Removal: File Deletion×1

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

Evidence: 2026-06-06/cve-2026-20245-cisco-catalyst-sd-wan-manager-actively-exploi · ATT&CK page ↗

Entries about Cisco Catalyst SD-WAN Manager command-injection to root; Mandiant confirms pre-disclosure zero-day exploitation; patched (chains CVE-2026-20127/-20182) (1)

2026-06-06 · view entry permalink →

HIGHCVE-2026-20245 +2exploitedupdatedNATOA1

CVE-2026-20245: Cisco Catalyst SD-WAN netadmin-to-root command injection exploited as a zero-day; fixed releases and a Live Protect shield available

CVE-2026-20245 (CVSS 7.8) is a privilege escalation in the CLI of Cisco Catalyst SD-WAN Controller, Manager and Validator: an authenticated, local attacker with netadmin privileges can inject commands through a crafted file and execute them as root (Cisco PSIRT). Netadmin access requires valid credentials or exploitation of the earlier authentication bypasses CVE-2026-20182 or CVE-2026-20127 (Cisco PSIRT). Cisco became aware of exploitation in June 2026 (Cisco PSIRT), NCSC Switzerland relayed the advisory (NCSC-CH, 2026-06-05), and CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-06-09 (CISA KEV catalog, 2026-06-09). First fixed releases are 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1 and 26.1.1.2; Cisco's Live Protect shield gives temporary coverage while upgrades are planned (Cisco PSIRT).

In June 2026, the Cisco PSIRT became aware of exploitation of this vulnerability.

Cisco PSIRT
Updaterun 2026-06-26-6bbe4619cvesevidencesourcestagsbody

Mandiant published a forensic reconstruction of an intrusion at a service provider in which CVE-2026-20245 was exploited as a zero-day (Mandiant, 2026-06-24). From late 2025 to January 2026 Mandiant observed unauthorized peering connections to the victim's SD-WAN Manager devices and considers it possible that they exploited CVE-2026-20127 or CVE-2026-20182, then undisclosed; further rogue peerings from March 2026 ran on a version unaffected by CVE-2026-20127, and Cisco confirmed they did not use CVE-2026-20182 either and could rely on stolen certificate material (Mandiant, 2026-06-24). In March the actor logged in over SSH as vmanage-admin and manipulated default account passwords; in April 2026, from an SSH session as admin, it passed a crafted CSV file to the request tenant-upload tenant-list command, whose payload appended a new UID-0 account to /etc/passwd and /etc/shadow (Mandiant, 2026-06-24). It then deleted the files it had created, reverted its configuration changes and ran a validation script (Mandiant, 2026-06-24).

Updaterun 2026-06-27-40e791d4cvesevidenceregionstagsbody

Mandiant's reconstruction dates the CVE-2026-20245 exploitation to April 2026, after rogue peering access that began in late 2025, and supports hunting for new UID-0 accounts and tenant-upload commands on Manager devices (Mandiant, 2026-06-24).

Correctionrun 2026-10-11T1307Z-audittitleheadlinesummaryevent_datetagssectorstechniquesaffected_productscvessourcesevidencesourcing_notereferencesclassificationactionsbody

Fixed releases exist for every supported train, and Cisco offers a Live Protect shield as temporary coverage (Cisco PSIRT). The flaw needs an authenticated attacker with netadmin privileges and scores 7.8 (Cisco PSIRT). Mandiant dates its zero-day exploitation to April 2026 at a service provider; the late-2025 to March activity was rogue peering, which may or may not have used the earlier bypasses, and the actor cleaned up by deleting its files and reverting configuration rather than wiping history or syslog (Mandiant, 2026-06-24).

Builds on: A forged vHub peer can plant an SSH key on Cisco SD-WAN controllers without credentials; Talos…

vulnerability06 Jun 05:00Zmulti-sourceOpen finding →
Sources: Cisco PSIRT · NCSC-CH · Mandiant · CISA KEV catalog

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • cisa.gov1 (25%)
  • cloud.google.com1 (25%)
  • sec.cloudapps.cisco.com1 (25%)
  • security-hub.ncsc.admin.ch1 (25%)

External references

NVD · cve.org · CISA KEV

All cited sources (4)