Cisco warns of unpatched SD-WAN zero-day exploited in attacks

# Cisco Catalyst SD-WAN Zero-Day Exploited in Active Attacks—Patches Unavailable

Cisco has issued an urgent warning of a critical, unpatched zero-day vulnerability in its Catalyst SD-WAN Manager that is actively being exploited in the wild to escalate privileges to root access. The flaw, tracked as CVE-2026-20245, represents yet another severe attack vector targeting the widely deployed network management platform, and comes as enterprises struggle with an escalating barrage of SD-WAN vulnerabilities at Cisco spanning back years.

The company confirmed exploitation in June following a report from Mandiant, the Google Cloud cybersecurity subsidiary, but disclosed no patches are currently available. What makes this situation particularly urgent is the vulnerability's position in a chain of attack techniques—requiring attackers to first gain netadmin privileges through other Cisco flaws—that suggests a sophisticated, multi-stage exploitation campaign targeting critical network infrastructure.

## The Threat

Cisco's Product Security Incident Response Team (PSIRT) disclosed that CVE-2026-20245 stems from insufficient validation of user-supplied input in the Catalyst SD-WAN Manager. The vulnerability allows local attackers with low privileges to execute arbitrary commands as root—the highest level of system access.

The attack workflow identified by Mandiant follows this pattern:

Indicators of Compromise (IOCs) shared by Cisco include specific log entries in /var/log/scripts.log:

Apr 15 09:44:57 vmanage vScript: Tenant list upload per vsmart serial number: 
/usr/bin/vconfd_script_upload_tenant_list.sh -cli path /home/admin/malicious.csv vpn 0

Security teams should search for similar patterns indicating attempts to upload tenant configuration data to vSmart controllers or other lateral movement activity.

## Background and Context

The Cisco Catalyst SD-WAN Manager (formerly vManage) is a critical piece of infrastructure for thousands of organizations worldwide. It provides centralized management and monitoring for up to 6,000 SD-WAN devices from a single dashboard, making it an extremely high-value target for attackers seeking to compromise entire network infrastructures.

This vulnerability does not exist in isolation. Cisco has disclosed a disturbing pattern of escalating SD-WAN vulnerabilities throughout 2026:

| CVE | Severity | Type | Status |

|-----|----------|------|--------|

| CVE-2026-20182 | Maximum | Authentication Bypass | Patched May 14, actively exploited |

| CVE-2026-20245 | High | Command Injection / Privilege Escalation | Unpatched, actively exploited |

| CVE-2026-20127 | Critical | Authentication Bypass | Patched, exploited since 2023 |

| CVE-2026-20133 | High | Information Disclosure | Patched February, exploited April-May |

| CVE-2026-20128 | High | (Details limited) | Patched, exploited in the wild |

| CVE-2026-20122 | High | (Details limited) | Patched, exploited in the wild |

According to CISA data, Cisco has accumulated 90 vulnerabilities flagged as exploited in the wild over several years, with at least four occurring in Catalyst SD-WAN Manager alone and six more leveraged by ransomware operations.

## Technical Details

To successfully exploit CVE-2026-20245, an attacker must follow a multi-stage approach:

Stage 1: Initial Access

The attacker must first obtain netadmin-level privileges on the SD-WAN Manager. This typically requires either:

Stage 2: Malicious File Upload

With netadmin privileges granted, the attacker uploads a crafted file designed to trigger the input validation flaw. The vulnerable code fails to properly sanitize user input before processing file uploads.

Stage 3: Command Injection & Privilege Escalation

The malicious file is processed by the system, and due to insufficient input validation, arbitrary commands are injected and executed with root privileges. This gives the attacker complete control over the SD-WAN Manager and, by extension, all connected edge devices.

Stage 4: Lateral Movement (Observed)

In limited observed cases, successful exploits allowed attackers to push malicious configurations to vSmart controllers and edge devices, potentially compromising the entire SD-WAN infrastructure. This represents a supply-chain-like attack vector where the centralized management platform becomes a beachhead for network-wide compromise.

The vulnerability affects all deployment types:

No deployment model is exempt.

## Implications for Organizations

Organizations running Cisco Catalyst SD-WAN Manager face several compounding risks:

Immediate Exposure: Until patches are released, any unpatched instance remains vulnerable to exploitation if an attacker can gain netadmin privileges through any available vector.

Chaining with Older Flaws: Attackers may chain this vulnerability with older, already-patched flaws (CVE-2026-20127, exploited since 2023) against organizations that haven't updated. This suggests threat actors are actively researching and weaponizing multiple SD-WAN attack chains.

Network-Wide Impact: Unlike application vulnerabilities, compromise of the SD-WAN Manager directly threatens the security posture of the entire network infrastructure, potentially affecting thousands of branch offices and remote sites.

Ransomware Risk: The history of similar Cisco flaws being exploited by ransomware operators (six documented cases) suggests this vulnerability may soon be weaponized in campaigns targeting critical infrastructure.

Regulatory and Compliance: Organizations subject to FedRAMP compliance must immediately assess whether government-deployed instances are vulnerable, as the flaw explicitly impacts the FedRAMP variant.

## Recommendations

Immediate Actions (This Week)

1. Patch CVE-2026-20182 if you haven't already. Cisco released patches on May 14, 2026. This removes one exploitation path for initial access.

2. Audit Access Logs: Search /var/log/scripts.log and authentication logs for suspicious upload attempts matching the IOCs provided. Look for unusual vScript activity or tenant configuration uploads.

3. Monitor Network Behavior: Establish monitoring for unexpected configuration pushes from the SD-WAN Manager to edge devices. Any unapproved changes represent a potential compromise.

4. Review Credentials: If netadmin credentials are reused or shared, rotate them immediately and implement credential isolation.

Short-Term Actions (This Month)

5. Network Segmentation: Restrict management access to the SD-WAN Manager to a hardened jump host or VPN. Limit who can connect and from where.

6. Vulnerability Scanning: Run comprehensive scans for CVE-2026-20127 and other SD-WAN flaws. The presence of exploitable older vulnerabilities indicates high risk.

7. Open a TAC Case: Contact Cisco Technical Assistance Center and request an admin-tech file review to determine if your instance has been compromised.

8. Patch Planning: Establish a timeline for patching once Cisco releases CVE-2026-20245 fixes. Prioritize this as a critical infrastructure update.

Long-Term Strategy

9. Evaluate Alternatives: The frequency and severity of Cisco SD-WAN vulnerabilities suggest evaluating alternative SD-WAN platforms or implementing defense-in-depth controls that don't rely solely on SD-WAN Manager security.

10. Zero-Trust Architecture: Transition network security away from perimeter-based models that depend on a single management point (like SD-WAN Manager) to zero-trust architectures with distributed security enforcement.

---

## HackWire Analysis

This vulnerability is emblematic of a critical vulnerability management crisis at Cisco—and a warning sign for enterprise network architects relying on centralized SD-WAN platforms.

What stands out: This is not the first, second, or even third critical SD-WAN flaw in 2026. We're witnessing a pattern of escalating attack chains where each new vulnerability is designed to be used *alongside* older ones. CVE-2026-20245 requires prior exploitation of CVE-2026-20127 (a flaw exploited since 2023 and patched in March). This suggests threat actors have weaponized a multi-stage attack path and are actively testing it in the wild.

The timing is also revealing. Cisco claims "limited cases" of actual compromise, yet Mandiant (a Google Cloud subsidiary with significant visibility into enterprise networks) reported it immediately. Limited doesn't mean non-critical—it means the window before mass exploitation is closing fast.

The real danger: No patch exists. For months, organizations face a choice between accepting risk or migrating away from SD-WAN Manager entirely. That's not a choice; that's a business continuity crisis for enterprises with thousands of remote sites managed through a single, compromised platform.

The implications go beyond one product. SD-WAN is now a standard enterprise practice—Cisco, VMware, and others are managing critical network traffic for millions of organizations. A vulnerability in SD-WAN management isn't a bug; it's an infrastructure-level risk. Any organization running production SD-WAN should immediately question whether centralized management platforms represent acceptable attack surface, or whether zero-trust, distributed security models are no longer optional.

The organizations most at risk: enterprises that patched CVE-2026-20182 but assume they're secure, and government agencies running FedRAMP variants who may face compliance complications if they need to isolate systems while awaiting patches.

Next move for defenders: Stop assuming your patches are current. Search for CVE-2026-20127 exploitation evidence in your logs dating back to early 2023. Assume your older flaws have been explored by skilled adversaries. Act accordingly.

— *HackWire Editorial*

---

## Related Coverage