Loading story…
Cisco disclosed a critical command injection flaw in Cisco Catalyst SD-WAN Manager (CVE-2026-20245) that is being actively exploited in the wild, allowing an authenticated local attacker with netadmin privileges to execute arbitrary commands as root. The vulnerability is caused by insufficient validation of file-transfer payloads in the CLI, and Cisco said observed exploitation has already resulted in unauthorized configuration changes being pushed from the manager to edge devices, raising the risk of broader network compromise in affected SD-WAN environments.
Cisco also warned the issue could be chained with the previously disclosed authenticated privilege-escalation bug CVE-2026-20182 to obtain the required access level before triggering command execution. At the time of disclosure, no standard software fix was available; administrators were advised to review logs, inspect scripts.log for suspicious activity, and work with Cisco Technical Assistance Center for mitigations and workarounds while assessing whether managed edge infrastructure had been altered.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Cisco disclosed that CVE-2026-20245, a critical command injection flaw in Cisco Catalyst SD-WAN Manager, was being actively exploited in the wild as of June 2026. Observed exploitation led to configuration changes being pushed to edge devices, and Cisco said no standard patch was yet available while mitigations were provided through TAC.
Acer released firmware version W6x_GBL_2.00.000008 or later for affected Connect W6x consumer wireless devices. The update fixes critical flaws including CVE-2026-49197 and CVE-2026-49199, along with three additional high-severity vulnerabilities.
On June 4, 2026, CVE records were published for several Acer issues, including CVE-2026-49190, CVE-2026-49193, CVE-2026-50206, CVE-2026-50207, and CVE-2026-50209. The entries describe impacts ranging from command injection and unauthorized command execution to public telemetry exposure and MDM endpoint takeover.
An Acer community security advisory about an upcoming firmware update for the Acer Connect M6E 5G Portable WiFi Router was published. This advisory is cited by later CVE records tied to multiple Acer vulnerabilities.
Cisco published a security advisory for an authenticated privilege escalation vulnerability in Cisco Catalyst SD-WAN Manager. The advisory corresponds to CVE-2026-20182, which was later noted as chainable with CVE-2026-20245.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesecurityonline.info
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecommunity.acer.com
Open sourcesec.cloudapps.cisco.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed active exploitation of **CVE-2026-20245**, a high-severity command injection flaw in **Cisco Catalyst SD-WAN Manager** that lets an authenticated attacker with `netadmin` privileges upload a crafted file and execute arbitrary commands as **root**. The vulnerability affects all deployment models, including on-premises, **Cisco SD-WAN Cloud**, Cloud-Pro, and FedRAMP environments, and Cisco said attackers have already used it in limited incidents to push unauthorized configuration changes to SD-WAN edge devices. Cisco said the flaw stems from insufficient validation and sanitization of user-supplied input in the CLI processing path, and warned that attackers may obtain the required privileges with valid credentials or by chaining previously disclosed bugs such as **CVE-2026-20182** or **CVE-2026-20127**. No dedicated patch or workaround was available at disclosure, so Cisco urged customers to upgrade to software versions that fix earlier exploited issues, review indicators of compromise such as suspicious entries in `/var/log/scripts.log`, preserve forensic evidence, collect diagnostics with the command: ```bash request admin-tech ``` and contact Cisco TAC if compromise is suspected.
Jun 29, 2026
Attackers have actively exploited multiple vulnerabilities in **Cisco Catalyst SD-WAN Manager** (`vManage`) to bypass authentication, escalate privileges to **root**, and alter downstream network infrastructure. Reporting on the campaign says the intrusion chain used critical auth-bypass flaws `CVE-2026-20127` and `CVE-2026-20182` for initial access, then leveraged `CVE-2026-20245` to execute commands as root through crafted file upload and command injection in the CLI. Cisco confirmed limited incidents in which exploitation led to configuration changes being pushed to edge devices, raising the risk that compromise of a single controller could affect broad SD-WAN environments. Cisco also disclosed active exploitation of `CVE-2026-20262`, a separate zero-day in Cisco Catalyst SD-WAN Manager that lets an authenticated low-privilege attacker abuse file-upload handling to create or overwrite files on the underlying operating system and gain root privileges. The flaw affects on-premises, Cloud, Cloud-Pro, and FedRAMP deployments, and Cisco released fixes in versions `20.9.9.2`, `20.12.7.2`, `20.15.4.5`, `20.15.5.3`, `20.18.3.1`, and `26.1.1.2`. U.S. authorities added exploited Cisco SD-WAN flaws to the **Known Exploited Vulnerabilities** catalog, and CISA issued **Emergency Directive 26-03** directing federal agencies to hunt for compromise and rapidly harden affected systems.
Jul 7, 2026
Cisco released security updates to address **CVE-2026-20245**, an authenticated local privilege escalation vulnerability in **Cisco Catalyst SD-WAN Manager**. The flaw stems from insufficient validation of user-supplied input during file upload, allowing a low-privileged local attacker to upload a crafted file, execute arbitrary commands, and escalate privileges to **root** on affected systems. The vulnerability carries a **CVSS score of 7.8** and requires low privileges, low attack complexity, and no user interaction. Security notices published in June urged organizations using affected SD-WAN Manager deployments to test and deploy Cisco's fixes as soon as possible to reduce the risk of post-authentication compromise of network management infrastructure.
Jul 8, 2026