# Cisco SD-WAN Manager Under Active Attack — Critical Vulnerability Chain Exposes Global Networks
A high-severity command injection flaw in Cisco Catalyst SD-WAN Manager is actively being exploited in the wild, marking the seventh critical SD-WAN vulnerability targeted by attackers this year alone. The vulnerability, tracked as CVE-2026-20245, allows authenticated local attackers to execute arbitrary commands with root privileges—but the threat is amplified by the existence of two prior authentication bypass flaws that eliminate the need for legitimate credentials entirely.
## The Threat
CVE-2026-20245 stems from insufficient input validation in the Cisco Catalyst SD-WAN Manager command-line interface. An attacker who uploads a specially crafted file to the system can inject arbitrary commands that execute with root-level privileges, effectively taking full control of the SD-WAN management plane. In practical terms, this means compromising the central control point that manages and configures every SD-WAN edge device across an organization's entire network.
What makes this vulnerability particularly dangerous is the attack chain it enables. While CVE-2026-20245 itself requires valid netadmin credentials or prior system access, Cisco has documented that attackers can chain it with two earlier authentication bypasses—CVE-2026-20182 (CVSS 10.0) and CVE-2026-20127. These flaws, disclosed months earlier, allow unauthenticated remote attackers to obtain administrative privileges without any valid credentials. The result: attackers can bypass authentication remotely, escalate to administrator access, and then exploit CVE-2026-20245 to achieve root command execution—all without ever knowing a legitimate password.
Cisco confirmed that active exploitation has occurred, with observed cases showing attackers modifying SD-WAN configurations and pushing those changes to edge devices across compromised networks. For organizations operating mission-critical branch connections through SD-WAN, this represents a direct path to network-wide compromise.
## Severity and Impact
| Field | Value |
|-------|-------|
| CVE ID | CVE-2026-20245 |
| CVSS Score | 7.8 (High) |
| CVSS Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Attack Vector | Local |
| Attack Complexity | Low |
| Privileges Required | Local netadmin privileges (or via CVE-2026-20182/CVE-2026-20127 auth bypass) |
| User Interaction | None |
| Scope | Unchanged |
| CWE | CWE-78 (Improper Neutralization of Special Elements used in an OS Command) |
## Affected Products
Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) affects all deployment architectures:
The vulnerability impacts all versions of Catalyst SD-WAN Manager currently in deployment. Cisco has not specified version-specific cutoffs, indicating that the flaw affects the current product line broadly.
## Mitigations
There are currently no patches or official workarounds available for CVE-2026-20245. This is a critical gap given active exploitation.
Cisco's interim recommendations:
1. Prioritize patches for authentication bypasses: Immediately upgrade to the May 14, 2026 security release that fixes CVE-2026-20182. This removes the unauthenticated attack vector that makes CVE-2026-20245 exploitable without valid credentials.
2. Monitor for indicators of compromise: Check the /var/log/scripts.log file for suspicious entries showing file uploads via the vScript functionality. Look for patterns like:
- vconfd_script_upload_tenant_list.sh with suspicious file paths
- vconfd_script_upload_vsmart_serial_numbers.sh operations
- vconfd_script_upload_chassis_number_file.sh activity
- Any entries referencing /home/admin/ with .csv files uploaded to unusual paths
3. Network segmentation: Restrict access to Catalyst SD-WAN Manager to trusted administrative networks. Internet-exposed instances are at highest risk. Implement strict network access controls and consider moving management interfaces behind a VPN or bastion host.
4. Credential hygiene: Audit netadmin account usage and enforce strong, unique credentials. Consider implementing multi-factor authentication at the application layer if available.
5. Monitor edge device configurations: Establish a baseline of your SD-WAN edge device configurations and monitor for unauthorized changes, which may indicate exploitation of this vulnerability to push malicious configuration updates.
6. Assume breach posture: Given that both CVE-2026-20182 and CVE-2026-20127 have been actively exploited as zero-days since 2023, organizations should assume their SD-WAN managers may already be compromised. Audit recent configuration changes and conduct threat-hunting in your network telemetry.
## References
---
## HackWire Analysis
The disclosure of CVE-2026-20245 reveals a troubling reality: SD-WAN has become the most-targeted component in Cisco's infrastructure portfolio in 2026. Seven active exploits against the SD-WAN management plane in a single calendar year—compared to historical patterns of 2-3 annually—signals a strategic shift by attackers who understand that compromising the SD-WAN manager gives them persistent, authenticated access to modify branch network traffic across entire organizations.
What's equally concerning is the vulnerability chain itself. CVE-2026-20182 carries a perfect 10.0 CVSS score and has been actively exploited as a zero-day since May 2026. The mere existence of an authentication bypass of that severity means organizations cannot rely on "we've removed it from the internet" as a mitigation—the flaw allows unauthenticated remote exploitation, period. CVE-2026-20127, with similar impact, has been known to be exploited in the wild since 2023, suggesting a three-year gap between discovery and public disclosure during which attackers had exclusive access to this technique.
For defenders, the absence of patches for CVE-2026-20245 combined with active exploitation is a worst-case scenario. Organizations cannot simply patch their way to safety; they must assume compromise and investigate. The fact that Cisco observed configuration changes pushed to edge devices is particularly alarming—this suggests attackers are not just gaining access to the management plane but actively operationalizing it to modify production SD-WAN configurations, potentially redirecting traffic or exfiltrating data through their chosen intermediaries.
The pattern emerging across 2026 suggests that attackers have systematically researched the SD-WAN attack surface, chained multiple vulnerabilities together to achieve escalating levels of access, and are now actively hunting for organizations still running unpatched systems. This is not opportunistic scanning—this is targeted, knowledge-based exploitation.
— *HackWire Editorial*
## Related Coverage