CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Cisco Catalyst SD-WAN Controller

product · product:cisco-catalyst-sd-wan-controller

Coverage
2
first 2026-05-15 → last 2026-10-11
Latest activity
2026-06-27
An attacker with netadmin access on Cisco SD-WAN can become root through a crafted tenant file; Mandiant saw…
Peak priority
critical
1 critical · 1 high
Targets
·
regions: switzerland
Sources cited
8
6 hosts

Action items (2)

Do-now tasks recorded on the entries about Cisco Catalyst SD-WAN Controller, newest first. Check the date before acting on an older one.

  • Upgrade every Catalyst SD-WAN Controller, Manager and Validator to its first fixed release (20.9.9.2, 20.12.7.2, 20.15.4.5 or 20.15.5.3, 20.18.3.1 or 26.1.1.2) after retaining logs, then check /etc/passwd and /etc/shadow for unexpected UID-0 accounts.
    2026-06-06CVE-2026-20245 +2
  • Immediate action: Run request admin-tech on every control component, then upgrade to a fixed release (for example 20.9.9.1, 20.12.7.1, 20.15.5.2, 20.18.2.2 or 26.1.1.1); check auth.log and control-connection history for the documented indicators, because on a compromised system the upgrade alone does not remediate.
    2026-05-15CVE-2026-20182

Defender insights

What each entry about Cisco Catalyst SD-WAN Controller tells a defender to do, newest first.

2026-06-06HIGHexploitedAn attacker with netadmin access on Cisco SD-WAN can become root through a crafted tenant file; Mandiant saw it used as a zero-day in April

Exposure · detection

2026-05-15CRITICALexploitedA forged vHub peer can plant an SSH key on Cisco SD-WAN controllers without credentials; Talos ties exploitation to UAT-8616

Exposure · detection

Story timeline

  1. 2026-06-06CVE-2026-20245: Cisco Catalyst SD-WAN netadmin-to-root command injection exploited as a zero-day; fixed releases and a Live Protect shield available
    trending-vulnerabilitiesAn attacker with netadmin access on Cisco SD-WAN can become root through a crafted tenant file; Mandiant saw it used as a zero-day in April
  2. 2026-05-15CVE-2026-20182: Cisco Catalyst SD-WAN peering authentication bypass (CVSS 10.0) exploited by UAT-8616; affects Controller, Manager and Validator
    trending-vulnerabilitiesA forged vHub peer can plant an SSH key on Cisco SD-WAN controllers without credentials; Talos ties exploitation to UAT-8616

Hunting pivots

CVEs (exploited first)
CVE-2026-20182 ×2CVE-2026-20127CVE-2026-20245
Releases covered
Cisco Catalyst SD-WAN Controller ×2
Tags
actively-exploited ×2cisa-kev ×2patch-available ×2pre-authpriv-escvulnerabilities
ATT&CK techniques (7 across 6 tactics)

7 techniques observed across 2 entries about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionCommand and Scripting Interpreter: Unix Shell
  • PersistenceAccount Manipulation: SSH Authorized Keys · Create Account: Local Account
  • Privilege EscalationExploitation for Privilege Escalation · Account Manipulation: SSH Authorized Keys
  • StealthIndicator Removal: File Deletion
  • Lateral MovementRemote Services: SSH

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-15/cve-2026-20182-cisco-catalyst-sd-wan-controller-manager-pre · ATT&CK page ↗

Execution TA0002

T1059.004Command and Scripting Interpreter: Unix Shell×1

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Evidence: 2026-06-06/cve-2026-20245-cisco-catalyst-sd-wan-manager-actively-exploi · ATT&CK page ↗

Persistence TA0003

T1098.004Account Manipulation: SSH Authorized Keys×1

Adversaries may modify the SSH <code>authorized_keys</code> file to maintain persistence on a victim host. Linux distributions, macOS, and ESXi hypervisors commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The <code>authorized_keys</code> file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured. This file is usually found in the user's home directory under <code>&lt;user-home&gt;/.ssh/authorized_keys</code> (or, on ESXi, `/etc/ssh/keys-<username>/authorized_keys`). Users may edit the system’s SSH config file to modify the directives `PubkeyAuthentication` and `RSAAuthentication` to the value `yes` to ensure public key and RSA authentication are enabled, as well as modify the directive `PermitRootLogin` to the value `yes` to enable root authentication via SSH. The SSH config file is usually located under <code>/etc/ssh/sshd_config</code>.

Evidence: 2026-05-15/cve-2026-20182-cisco-catalyst-sd-wan-controller-manager-pre · ATT&CK page ↗

T1136.001Create Account: Local Account×1

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

Evidence: 2026-06-06/cve-2026-20245-cisco-catalyst-sd-wan-manager-actively-exploi · ATT&CK page ↗

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-06-06/cve-2026-20245-cisco-catalyst-sd-wan-manager-actively-exploi · ATT&CK page ↗

T1098.004Account Manipulation: SSH Authorized Keys×1

Adversaries may modify the SSH <code>authorized_keys</code> file to maintain persistence on a victim host. Linux distributions, macOS, and ESXi hypervisors commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The <code>authorized_keys</code> file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured. This file is usually found in the user's home directory under <code>&lt;user-home&gt;/.ssh/authorized_keys</code> (or, on ESXi, `/etc/ssh/keys-<username>/authorized_keys`). Users may edit the system’s SSH config file to modify the directives `PubkeyAuthentication` and `RSAAuthentication` to the value `yes` to ensure public key and RSA authentication are enabled, as well as modify the directive `PermitRootLogin` to the value `yes` to enable root authentication via SSH. The SSH config file is usually located under <code>/etc/ssh/sshd_config</code>.

Evidence: 2026-05-15/cve-2026-20182-cisco-catalyst-sd-wan-controller-manager-pre · ATT&CK page ↗

Stealth TA0005

T1070.004Indicator Removal: File Deletion×1

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

Evidence: 2026-06-06/cve-2026-20245-cisco-catalyst-sd-wan-manager-actively-exploi · ATT&CK page ↗

Lateral Movement TA0008

T1021.004Remote Services: SSH×1

Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.

Evidence: 2026-05-15/cve-2026-20182-cisco-catalyst-sd-wan-controller-manager-pre · ATT&CK page ↗

Entries about Cisco Catalyst SD-WAN Controller (2)

2026-06-06 · view entry permalink →

HIGHCVE-2026-20245 +2exploitedupdatedNATOA1

CVE-2026-20245: Cisco Catalyst SD-WAN netadmin-to-root command injection exploited as a zero-day; fixed releases and a Live Protect shield available

CVE-2026-20245 (CVSS 7.8) is a privilege escalation in the CLI of Cisco Catalyst SD-WAN Controller, Manager and Validator: an authenticated, local attacker with netadmin privileges can inject commands through a crafted file and execute them as root (Cisco PSIRT). Netadmin access requires valid credentials or exploitation of the earlier authentication bypasses CVE-2026-20182 or CVE-2026-20127 (Cisco PSIRT). Cisco became aware of exploitation in June 2026 (Cisco PSIRT), NCSC Switzerland relayed the advisory (NCSC-CH, 2026-06-05), and CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-06-09 (CISA KEV catalog, 2026-06-09). First fixed releases are 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1 and 26.1.1.2; Cisco's Live Protect shield gives temporary coverage while upgrades are planned (Cisco PSIRT).

In June 2026, the Cisco PSIRT became aware of exploitation of this vulnerability.

Cisco PSIRT
Updaterun 2026-06-26-6bbe4619cvesevidencesourcestagsbody

Mandiant published a forensic reconstruction of an intrusion at a service provider in which CVE-2026-20245 was exploited as a zero-day (Mandiant, 2026-06-24). From late 2025 to January 2026 Mandiant observed unauthorized peering connections to the victim's SD-WAN Manager devices and considers it possible that they exploited CVE-2026-20127 or CVE-2026-20182, then undisclosed; further rogue peerings from March 2026 ran on a version unaffected by CVE-2026-20127, and Cisco confirmed they did not use CVE-2026-20182 either and could rely on stolen certificate material (Mandiant, 2026-06-24). In March the actor logged in over SSH as vmanage-admin and manipulated default account passwords; in April 2026, from an SSH session as admin, it passed a crafted CSV file to the request tenant-upload tenant-list command, whose payload appended a new UID-0 account to /etc/passwd and /etc/shadow (Mandiant, 2026-06-24). It then deleted the files it had created, reverted its configuration changes and ran a validation script (Mandiant, 2026-06-24).

Updaterun 2026-06-27-40e791d4cvesevidenceregionstagsbody

Mandiant's reconstruction dates the CVE-2026-20245 exploitation to April 2026, after rogue peering access that began in late 2025, and supports hunting for new UID-0 accounts and tenant-upload commands on Manager devices (Mandiant, 2026-06-24).

Correctionrun 2026-10-11T1307Z-audittitleheadlinesummaryevent_datetagssectorstechniquesaffected_productscvessourcesevidencesourcing_notereferencesclassificationactionsbody

Fixed releases exist for every supported train, and Cisco offers a Live Protect shield as temporary coverage (Cisco PSIRT). The flaw needs an authenticated attacker with netadmin privileges and scores 7.8 (Cisco PSIRT). Mandiant dates its zero-day exploitation to April 2026 at a service provider; the late-2025 to March activity was rogue peering, which may or may not have used the earlier bypasses, and the actor cleaned up by deleting its files and reverting configuration rather than wiping history or syslog (Mandiant, 2026-06-24).

Builds on: A forged vHub peer can plant an SSH key on Cisco SD-WAN controllers without credentials; Talos…

vulnerability06 Jun 05:00Zmulti-sourceOpen finding →
Sources: Cisco PSIRT · NCSC-CH · Mandiant · CISA KEV catalog

2026-05-15 · view entry permalink →

CRITICALCVE-2026-20182exploitedupdatedNATOA1

CVE-2026-20182: Cisco Catalyst SD-WAN peering authentication bypass (CVSS 10.0) exploited by UAT-8616; affects Controller, Manager and Validator

CVE-2026-20182 (CVSS 10.0, CWE-287) is an authentication bypass in the peering authentication of Cisco Catalyst SD-WAN Controller, Manager and, since Cisco's advisory revision of 2026-06-16, Validator, affecting all deployment types regardless of configuration (Cisco PSIRT). Rapid7 showed the mechanism on the Controller: the vdaemon DTLS control-plane service on UDP/12346 accepts a CHALLENGE_ACK claiming device type 2 (vHub) from a self-signed peer without verifying it, after which message type 14 (MSG_VMANAGE_TO_PEER) appends an attacker SSH key to /home/vmanage-admin/.ssh/authorized_keys, giving NETCONF access on TCP/830 as vmanage-admin (Rapid7, 2026-05-14). Rapid7 demonstrates the bypass with its own Metasploit module, submitted to the public Metasploit Framework repository (Rapid7, 2026-05-14). Cisco became aware of limited exploitation in May 2026 (Cisco PSIRT), and Talos attributes it to UAT-8616, a highly sophisticated actor that attempted to add SSH keys, modify NETCONF configurations and escalate to root (Cisco Talos, 2026-05-14). Talos separately tracks ten other clusters, distinct from UAT-8616, that exploit the earlier SD-WAN Manager flaws CVE-2026-20133, CVE-2026-20128 and CVE-2026-20122 with public proof-of-concept code (Cisco Talos, 2026-05-14). CISA added CVE-2026-20182 to its Known Exploited Vulnerabilities catalog on 2026-05-14 (CISA KEV catalog, 2026-05-14), under its existing Emergency Directive 26-03 for Cisco SD-WAN, first issued on 2026-02-25 (CISA ED 26-03).

Cisco lists no workaround; first fixed releases are 20.9.9.1, 20.12.5.4, 20.12.6.2 or 20.12.7.1, 20.15.4.4 or 20.15.5.2, 20.18.2.2 and 26.1.1.1, releases before 20.9 must migrate, and 20.10, 20.11, 20.13, 20.14 and 20.16 move to the next fixed train (Cisco PSIRT).

In May 2026, the Cisco Product Security Incident Response Team (PSIRT) became aware of limited exploitation of this vulnerability.

Cisco PSIRT
Correctionrun 2026-10-11T1307Z-audittitleheadlinesummaryimmediate_actiontagsentitiestechniquesaffected_productscvessourcesevidencesourcing_notereferencesclassificationbody

CISA's Emergency Directive 26-03 was first issued on 2026-02-25; on 2026-05-14 CISA added CVE-2026-20182 to its KEV catalog under it (CISA ED 26-03) (CISA KEV catalog, 2026-05-14). The SSH-key and NETCONF path Rapid7 demonstrated is on the SD-WAN Controller (Rapid7, 2026-05-14), and Cisco has since added the Validator to the affected products (Cisco PSIRT). Talos's ten other clusters exploit the separate SD-WAN Manager flaws CVE-2026-20133, CVE-2026-20128 and CVE-2026-20122, not this one (Cisco Talos, 2026-05-14). Cisco lists no workaround and no source proposes segmentation as one. Rapid7 demonstrates the bypass with its own Metasploit module, submitted to the public Metasploit Framework repository, so a working exploit is public (Rapid7, 2026-05-14).

Builds on: An attacker with netadmin access on Cisco SD-WAN can become root through a crafted tenant file…

vulnerability15 May 05:00Zmulti-sourceOpen finding →
Sources: Cisco PSIRT · Rapid7 · Cisco Talos · CISA KEV catalog · CISA ED 26-03

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns2

Source distribution

  • cisa.gov2 (25%)
  • sec.cloudapps.cisco.com2 (25%)
  • blog.talosintelligence.com1 (12%)
  • cloud.google.com1 (12%)
  • rapid7.com1 (12%)
  • security-hub.ncsc.admin.ch1 (12%)
All cited sources (8)