# Cisco Warns of 7th SD-WAN Zero-Day Exploited in 2026—Root-Level Command Execution Vulnerability CVE-2026-20245


Cisco has disclosed another critical vulnerability in its Catalyst SD-WAN Manager product, marking the seventh zero-day vulnerability exploited against the company's SD-WAN portfolio in 2026 alone. The flaw, tracked as CVE-2026-20245, allows authenticated attackers with limited system privileges to execute arbitrary commands as root, but remains unpatched as of June 5, 2026.


The disclosure underscores an alarming pattern: Cisco's SD-WAN infrastructure has become a primary target for sophisticated threat actors, with attackers chaining multiple vulnerabilities to escalate privileges and maintain persistent access to edge devices across enterprise networks.


## The Threat


CVE-2026-20245 is a command injection vulnerability in the CLI of Cisco Catalyst SD-WAN Manager that stems from insufficient input validation. An attacker who uploads a specially crafted file can trigger arbitrary command execution with root-level privileges on the affected system.


Key vulnerability characteristics:


  • CVSS Score: Not yet disclosed
  • Attack Vector: Local, authenticated
  • Privilege Escalation: Yes—commands execute as root
  • Current Status: Unpatched; no workarounds available
  • Exploit Maturity: In-the-wild exploitation confirmed

    • The critical detail: attackers need 'netadmin' privileges on the target system to exploit the vulnerability. While this might suggest a limited attack surface, Cisco's own advisory reveals how attackers readily obtain these credentials through prior SD-WAN compromises.


    According to Cisco's Product Security Incident Response Team (PSIRT), the company observed exploitation in early June 2026—a timeline that suggests active, ongoing attacks before the vendor's coordinated disclosure.


    ## Background and Context


    This is not an isolated incident. CVE-2026-20245 represents part of a systematic exploitation campaign targeting Cisco's SD-WAN ecosystem:


    | CVE ID | Description | Status | Exploited By |

    |--------|-------------|--------|--------------|

    | CVE-2026-20245 | CLI command injection (root execution) | Unpatched | UAT-8616 + others |

    | CVE-2026-20182 | Authentication bypass | Patched (May 2026) | UAT-8616 |

    | CVE-2026-20127 | Unauthorized access | Patched | UAT-8616 |

    | CVE-2026-20128 | (Exploited in 2026) | Status unclear | Unknown |

    | CVE-2026-20122 | (Exploited in 2026) | Status unclear | Unknown |

    | CVE-2026-20133 | (Exploited in 2026) | Status unclear | Unknown |

    | CVE-2022-20775 | (Older flaw) | Exploitation in 2026 | Unknown |


    ### The Exploitation Chain


    Security researchers have documented a clear attack progression. Threat actors, primarily tracked as UAT-8616, initially exploited CVE-2026-20182 (authentication bypass) to gain initial access to Catalyst SD-WAN Manager systems. From there, they could either:


    1. Escalate to full system compromise using CVE-2026-20245

    2. Move laterally through the network via compromised edge devices

    3. Manipulate SD-WAN configurations to intercept or reroute traffic


    ### Why SD-WAN Is a High-Value Target


    SD-WAN Manager is a critical infrastructure chokepoint. It controls:

  • Network traffic routing across edge devices
  • VPN tunnel configuration and encryption
  • Branch office connectivity policies
  • Traffic segmentation and quality-of-service rules

    • A compromised SD-WAN Manager gives attackers the ability to pivot across dozens or hundreds of branch locations from a single system.


    ## Technical Details


    ### The Vulnerability Mechanism


    CVE-2026-20245 exploits insufficient input validation in the CLI of Cisco Catalyst SD-WAN Manager. The flaw allows an attacker to:


    1. Craft a malicious file containing shell metacharacters or command injection payloads

    2. Upload the file via the CLI interface (requires netadmin credentials)

    3. Trigger command execution when the system processes the file


    Because the system runs with root privileges during file processing, the injected commands execute with full system access. This enables attackers to:


  • Read sensitive configuration files
  • Extract credentials or encryption keys
  • Modify system settings
  • Establish persistence mechanisms
  • Deploy additional malware

    • ### Exploitation Requirements


    While CVE-2026-20245 is serious, it requires specific preconditions:


  • Authenticated access with 'netadmin' privileges
  • Local file upload capability via the CLI
  • File processing by a vulnerable subsystem

    • The catch: attackers readily obtain netadmin credentials through:

  • Exploitation of CVE-2026-20182 (authentication bypass)
  • Credential theft during earlier breaches
  • Stolen employee accounts
  • Compromised partner systems with administrative access

    • ### Real-World Impact Observed


    Cisco stated: *"Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices."*


    This suggests that successful exploits have enabled attackers to:

  • Modify routing policies
  • Alter encryption settings
  • Redirect traffic through attacker-controlled nodes
  • Potentially intercept encrypted communications

    • ## Implications


    ### Immediate Risks


    Organizations running Cisco Catalyst SD-WAN Manager face several critical risks:


    1. Unpatched vulnerability in production: No patch is available, forcing organizations into a holding pattern with active threats

    2. Supply chain visibility: If your SD-WAN Manager is compromised, every edge device and branch office is at potential risk

    3. Dwell time uncertainty: Cisco only disclosed exploitation once discovered in June; organizations cannot determine how long attackers may have had access

    4. Configuration tampering: Legitimate traffic policies may have been altered without detection


    ### Broader Threat Landscape


    The frequency of Cisco SD-WAN vulnerabilities in 2026 indicates:


  • Insufficient initial security posture: Seven zero-days in a single product line suggests design or implementation weaknesses
  • Attackers targeting supply chain convergence points: SD-WAN Managers control network behavior at scale
  • Possible reconnaissance for larger campaigns: Early access via CVE-2026-20182 may have enabled threat actors to survey networks for additional vulnerabilities

    • ## Recommendations


    ### Immediate Actions (Next 24–48 Hours)


    1. Audit access logs on all Cisco Catalyst SD-WAN Manager instances for suspicious file uploads or CLI activity

    2. Review SD-WAN configurations for unauthorized changes, especially routing policies or encryption settings

    3. Enable enhanced logging if available; retain logs for forensic analysis

    4. Restrict network access to the management interface—limit access to administrative staff only

    5. Monitor Cisco's advisory page for patch availability and guidance


    ### Short-Term Mitigations (1–2 Weeks)


  • Rotate all netadmin credentials on SD-WAN Manager systems
  • Revoke API tokens and re-authenticate integrations
  • Isolate management interfaces from general network traffic via network segmentation
  • Conduct vulnerability scans of all SD-WAN devices to identify any suspicious configurations
  • Engage Mandiant or incident response firm if you operate large SD-WAN deployments

    • ### Medium-Term Actions (2–4 Weeks)


  • Plan migration to patched versions once Cisco releases an update
  • Validate patch applicability in your environment before deployment
  • Implement compensating controls: network segmentation, endpoint detection and response (EDR), and zero-trust authentication for management access
  • Review SD-WAN security architecture for defense-in-depth improvements

    • ### Long-Term Strategy


  • Diversify SD-WAN vendors to reduce single-vendor risk
  • Implement zero-trust principles for management access
  • Establish threat intelligence feeds specific to SD-WAN vulnerabilities
  • Conduct tabletop exercises simulating SD-WAN compromise scenarios

    • ## HackWire Analysis


    The seventh Cisco SD-WAN zero-day in 2026 reveals a critical pattern: attackers have systematized the exploitation of SD-WAN infrastructure as an attack vector. Unlike isolated vulnerabilities, this chain of flaws—CVE-2026-20182, CVE-2026-20127, and now CVE-2026-20245—suggests either a fundamental architectural weakness in Cisco's product line or a gap in pre-release security testing.


    What's particularly alarming is the supply-chain leverage these vulnerabilities provide. An attacker compromising a single SD-WAN Manager can influence traffic routing, encryption, and access policies across an entire enterprise's branch network. This isn't just a single system compromise—it's a pivot point for network-wide attacks. For organizations with dozens of branches, a compromised SD-WAN Manager is effectively a master key to the entire distributed network.


    The fact that Mandiant discovered this vulnerability and that in-the-wild exploitation was observed in June suggests attackers have already begun weaponizing it. Organizations cannot wait for patches; they must assume active compromise is possible and implement detective controls—log analysis, anomalous configuration detection, and network traffic inspection—immediately.


    The deeper question: why are enterprises still deploying single points of failure for network management? The SD-WAN category was supposed to simplify branch connectivity, but instead it has created a new target for adversaries. Until vendors and enterprises address the security-by-design gap in SD-WAN platforms, these disclosures will continue.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)