Loading story…
Cisco disclosed active exploitation of CVE-2026-20245, a high-severity command injection flaw in Cisco Catalyst SD-WAN Manager that lets an authenticated attacker with netadmin privileges upload a crafted file and execute arbitrary commands as root. The vulnerability affects all deployment models, including on-premises, Cisco SD-WAN Cloud, Cloud-Pro, and FedRAMP environments, and Cisco said attackers have already used it in limited incidents to push unauthorized configuration changes to SD-WAN edge devices.
Cisco said the flaw stems from insufficient validation and sanitization of user-supplied input in the CLI processing path, and warned that attackers may obtain the required privileges with valid credentials or by chaining previously disclosed bugs such as CVE-2026-20182 or CVE-2026-20127. No dedicated patch or workaround was available at disclosure, so Cisco urged customers to upgrade to software versions that fix earlier exploited issues, review indicators of compromise such as suspicious entries in /var/log/scripts.log, preserve forensic evidence, collect diagnostics with the command:
request admin-tech
and contact Cisco TAC if compromise is suspected.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Cisco published a security advisory for a Cisco Catalyst SD-WAN Manager arbitrary file write vulnerability, identifying a new security issue affecting the product line beyond the previously tracked CVE-2026-20245 disclosure.
CISA updated its Known Exploited Vulnerabilities catalog to include CVE-2026-20245, the actively exploited Cisco Catalyst SD-WAN Manager command injection flaw. The catalog update placed the Cisco issue alongside newly added Chromium and Arista vulnerabilities flagged as exploited in the wild.
Alongside the disclosure, Cisco shared indicators of compromise such as suspicious entries in /var/log/scripts.log and advised customers to preserve forensic evidence, collect admin-tech data, and contact Cisco TAC for compromise assessment. Cisco also recommended upgrading to software versions that already fix the previously exploited CVE-2026-20182 while awaiting a dedicated fix for CVE-2026-20245.
Cisco publicly disclosed CVE-2026-20245, a high-severity command injection and privilege-escalation flaw in Cisco Catalyst SD-WAN Manager that can let an authenticated attacker with netadmin privileges execute commands as root. At disclosure, Cisco said the vulnerability was being actively exploited in the wild, affected all deployment models, and had no dedicated patch or workaround available.
Cisco said it learned in June of active exploitation of CVE-2026-20245 in Catalyst SD-WAN Manager after receiving a report from Mandiant. The observed activity included limited incidents in which attackers pushed unauthorized configuration changes to SD-WAN edge devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
15 references tracked. Mallory keeps watching after this page renders.
sec.cloudapps.cisco.com
Open sourcesecurityaffairs.com
Open sourcesecurityonline.info
Open sourcecyberscoop.com
Open sourcetheregister.com
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourcesdxcentral.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed a critical command injection flaw in **Cisco Catalyst SD-WAN Manager** (`CVE-2026-20245`) that is being actively exploited in the wild, allowing an authenticated local attacker with `netadmin` privileges to execute arbitrary commands as `root`. The vulnerability is caused by insufficient validation of file-transfer payloads in the CLI, and Cisco said observed exploitation has already resulted in unauthorized configuration changes being pushed from the manager to edge devices, raising the risk of broader network compromise in affected SD-WAN environments. Cisco also warned the issue could be chained with the previously disclosed authenticated privilege-escalation bug `CVE-2026-20182` to obtain the required access level before triggering command execution. At the time of disclosure, no standard software fix was available; administrators were advised to review logs, inspect `scripts.log` for suspicious activity, and work with Cisco Technical Assistance Center for mitigations and workarounds while assessing whether managed edge infrastructure had been altered.
Jun 29, 2026
Attackers have actively exploited multiple vulnerabilities in **Cisco Catalyst SD-WAN Manager** (`vManage`) to bypass authentication, escalate privileges to **root**, and alter downstream network infrastructure. Reporting on the campaign says the intrusion chain used critical auth-bypass flaws `CVE-2026-20127` and `CVE-2026-20182` for initial access, then leveraged `CVE-2026-20245` to execute commands as root through crafted file upload and command injection in the CLI. Cisco confirmed limited incidents in which exploitation led to configuration changes being pushed to edge devices, raising the risk that compromise of a single controller could affect broad SD-WAN environments. Cisco also disclosed active exploitation of `CVE-2026-20262`, a separate zero-day in Cisco Catalyst SD-WAN Manager that lets an authenticated low-privilege attacker abuse file-upload handling to create or overwrite files on the underlying operating system and gain root privileges. The flaw affects on-premises, Cloud, Cloud-Pro, and FedRAMP deployments, and Cisco released fixes in versions `20.9.9.2`, `20.12.7.2`, `20.15.4.5`, `20.15.5.3`, `20.18.3.1`, and `26.1.1.2`. U.S. authorities added exploited Cisco SD-WAN flaws to the **Known Exploited Vulnerabilities** catalog, and CISA issued **Emergency Directive 26-03** directing federal agencies to hunt for compromise and rapidly harden affected systems.
Jul 7, 2026
Cisco released fixes for **CVE-2026-20262**, an actively exploited vulnerability in **Cisco Catalyst SD-WAN Manager** (`vManage`) that allows an authenticated remote attacker with low privileges to upload or overwrite files through crafted HTTP requests and ultimately execute commands as **root**. The flaw stems from insufficient validation of user-supplied input during file uploads in the web UI and affects **all deployment models**, including on-premises, Cloud-Pro, Cisco-managed cloud, and FedRAMP environments. Cisco said it became aware of in-the-wild exploitation in June and urged customers to patch immediately, warning that the product’s central role in orchestrating SD-WAN fabrics raises the operational impact of compromise. The company published indicators of compromise tied to uploaded `.jsp` and `.war` files, including filenames such as `index.jsp` and `suspicious.war`, and advised defenders to inspect `vmanage-server`, `vmanage-appserver`, and `serviceproxy-access` logs, reduce internet exposure, audit accounts, and contact TAC with an admin-tech file if intrusion is suspected.
Jun 29, 2026