A critical vulnerability in Cisco’s Catalyst SD-WAN Manager has been identified, allowing attackers to execute commands with root privileges. This flaw is actively being exploited, posing significant risks to affected systems.
Understanding the Vulnerability
The vulnerability, designated as CVE-2026-20245, features a CVSS score of 7.8. It arises from inadequate input validation in the command-line interface. Insufficient sanitization during file uploads enables authenticated attackers to inject commands, escalating privileges to root.
Once root access is gained, attackers can compromise the management plane, alter configurations, and potentially affect connected devices. Exploiting this flaw requires netadmin-level access, safeguarding it from unauthorized external attacks.
Exploitation and Risks
Cisco highlights the risk of chaining this vulnerability with others like CVE-2026-20182, increasing real-world threat levels. Cisco’s PSIRT has confirmed limited exploitation of this flaw, with attackers using it to alter configurations on SD-WAN edge devices, indicating attempts at persistence and network manipulation.
The vulnerability impacts all Cisco Catalyst SD-WAN Manager deployments, including on-premises, cloud, and government systems. Externally exposed systems are particularly vulnerable, especially those with accessible management interfaces.
Mitigation and Response
Currently, Cisco has not issued a software patch for this specific issue. Customers are advised to upgrade to a fixed version noted in a May 2026 advisory while a dedicated fix is developed.
Cisco advises administrators to scrutinize the scripts.log file for suspicious entries, such as unexpected file paths in command executions. However, these logs may include legitimate activities, necessitating careful analysis to prevent false positives.
Organizations should collect forensic data using the “request admin-tech” command before any upgrades, preserving evidence of potential compromise. It’s crucial to review configurations and logs post-upgrade, as patching alone may not rectify systems already infiltrated.
Collaboration and Future Steps
This vulnerability, reported by Mandiant, underscores the importance of collaboration between vendors and threat intelligence teams. With active exploitation ongoing, organizations must prioritize access controls, monitoring, and log analysis to mitigate risks until a permanent solution is available.
Follow us on Google News, LinkedIn, and X for more updates on cybersecurity threats and resolutions.
