Threat reportVulnerabilityTL-2026-0696
Cisco Catalyst SD-WAN Manager CVE-2026-20245 — Actively Exploited 0-Day: Authenticated File-Upload Command Injection to Root
Cisco Catalyst SD-WAN Manager CVE-2026-20245 (TL-2026-0696), also tracked as 7th Cisco SD-WAN Zero-Day of 2026, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-06-06. It is attributed to UAT-8616 with low confidence, affects Cisco Catalyst SD-WAN Manager (vManage), references 3 CVEs (CVE-2026-20245, CVE-2026-20127, CVE-2026-20182), maps to 10 MITRE ATT&CK techniques (T1021, T1059.004, T1068), and is covered by 9 detection rules and 12 indicators of compromise.
- CVSS
- 7.8/10High
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 10MITRE ATT&CK
- Actors
- 1UAT-8616
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-0696
- Threat ID
- TL-2026-0696
- Also known as
- 7th Cisco SD-WAN Zero-Day of 2026
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution
- UAT-8616
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- telecommunications, government, financial, enterprise, managed-service-providers
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Cisco Catalyst SD-WAN Manager CVE-2026-20245
Malware and tooling: request admin-tech
How Cisco Catalyst SD-WAN Manager CVE-2026-20245 works
Cisco disclosed CVE-2026-20245, an actively exploited zero-day in Catalyst SD-WAN Manager (formerly vManage). Insufficient validation of an uploaded file in the CLI component lets an authenticated attacker with netadmin privileges inject and execute arbitrary OS commands as root. No patch or workaround is available; Mandiant reported in-the-wild exploitation and Cisco PSIRT observed cases where attackers pushed configuration changes to edge devices.
CVE-2026-20245 is a high-severity command-injection vulnerability (CVSS 3.1 base 7.8) in the command-line interface of Cisco Catalyst SD-WAN Manager, the centralized management plane (formerly branded vManage) for Cisco SD-WAN fabrics. The root cause is insufficient validation of user-supplied input contained in a file uploaded through the management interface. An attacker who already holds netadmin-level privileges can craft a file whose contents are passed into a privileged shell helper script, breaking out of the intended data context and injecting arbitrary operating-system commands that execute with root privileges on the underlying appliance.
The vulnerability is a privilege-escalation primitive rather than an initial-access primitive: it requires authenticated netadmin access. In observed activity, adversaries chained it with one of two SD-WAN Manager authentication-bypass flaws to first obtain the required role — CVE-2026-20182 (CVSS 10.0 authentication bypass, patched mid-May 2026) or CVE-2026-20127 (authentication bypass leveraged by sophisticated actors since 2023). Once netadmin is achieved, CVE-2026-20245 converts that web-tier foothold into full root control of the controller, from which the operator can read secrets, manipulate the SD-WAN control plane, and push malicious configuration to managed edge devices.
Exploitation abuses the legitimate vconfd helper scripts that vManage invokes to ingest operator-supplied data files (tenant lists, vSmart serial-number files, chassis-number files). These scripts are called with a path to the uploaded file; because the file's contents are not properly sanitized before being incorporated into a shell command line, malicious content is interpreted as commands. Forensic evidence appears in /var/log/scripts.log, where the helper invocations (for example a tenant-list upload referencing an attacker-controlled CSV path) are logged. Cisco PSIRT observed a limited number of successful cases in which exploitation resulted in configuration data being uploaded to vSmart controllers and configuration changes being propagated to edge devices, indicating intent to gain durable control over the routed fabric rather than mere host compromise.
All deployment models are affected: on-premises, Cisco SD-WAN Cloud-Pro, Cisco-managed SD-WAN Cloud, and the FedRAMP Cisco SD-WAN for Government offering. At disclosure (5 June 2026) no fixed software release and no workaround existed; Cisco directed customers to upgrade to releases that remediate CVE-2026-20182, to run 'request admin-tech' on control components to preserve forensic evidence before upgrading, to verify edge-device configurations, and to engage TAC for remediation of confirmed compromises. CVE-2026-20245 is the seventh actively exploited Cisco SD-WAN zero-day tracked in 2026, part of a sustained campaign against this widely deployed network-management infrastructure. The threat cluster UAT-8616, previously tied to exploitation of CVE-2026-20182 and CVE-2026-20127, is the leading candidate operator, though Cisco has not confirmed attribution for CVE-2026-20245 specifically.
MITRE ATT&CK techniques used in TL-2026-0696
Lateral Movement
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Credential Access
defense-impairment
T1601 Modify System Image; T1685.006 Clear Linux or Mac System Logs
persistence
Affected products and versions in Cisco Catalyst SD-WAN Manager CVE-2026-20245
- Cisco — Catalyst SD-WAN Manager (vManage)
Vulnerable versions: On-Prem; SD-WAN Cloud-Pro; SD-WAN Cloud (Cisco Managed); SD-WAN for Government (FedRAMP)
Fixed in: No fixed release available as of 2026-06-05
Remediation for Cisco Catalyst SD-WAN Manager CVE-2026-20245
Patches
- No fix available for CVE-2026-20245 as of 2026-06-05; Cisco to deliver in a future release
- Upgrade to SD-WAN Manager releases that remediate CVE-2026-20182 (patched 2026-05-14) to remove the primary chaining vector
Immediate actions
- Run 'request admin-tech' on all SD-WAN control components to preserve forensic evidence before any upgrade
- Restrict and audit netadmin-level accounts on Catalyst SD-WAN Manager; rotate credentials and enforce MFA on management access
- Inspect /var/log/scripts.log for unexpected vconfd_script_upload_* invocations referencing attacker-controlled file paths
- Verify edge-device and vSmart configurations against a known-good baseline for unauthorized changes
Workarounds
- No workaround available per Cisco advisory cisco-sa-sdwan-privesc-4uxFrdzx
Longer-term hardening
- Place SD-WAN Manager management interfaces behind segmented, access-controlled networks; never expose to the internet
- Deploy host/network monitoring to alert on anomalous file uploads and shell activity on controllers
- Implement configuration drift detection across the SD-WAN fabric
CVEs associated with Cisco Catalyst SD-WAN Manager CVE-2026-20245
Weaknesses (CWE) in Cisco Catalyst SD-WAN Manager CVE-2026-20245
Timeline of Cisco Catalyst SD-WAN Manager CVE-2026-20245
- Chaining CVEs CVE-2026-20127 (authentication bypass) and CVE-2026-20133 begin being leveraged by sophisticated actors against Cisco SD-WAN, per Cisco.
- Cisco patches CVE-2026-20182 (CVSS 10.0 authentication bypass), the primary chaining vector used to reach netadmin for CVE-2026-20245.
- Mandiant (Chester Sng, Pete Boonyakarn, Logeswaran Nadarajan) reports active in-the-wild exploitation of CVE-2026-20245 to Cisco PSIRT.
- Cisco PSIRT confirms limited successful cases where exploitation pushed configuration changes to vSmart controllers and edge devices.
- Cisco publishes advisory cisco-sa-sdwan-privesc-4uxFrdzx for CVE-2026-20245; no patch or workaround available. Seventh SD-WAN zero-day of 2026.
- Threadlinqs Intelligence documents the threat with full MITRE mapping, IOCs, and detection guidance.
Sources cited for Cisco Catalyst SD-WAN Manager CVE-2026-20245
- Cisco Security Advisory cisco-sa-sdwan-privesc-4uxFrdzx
- New Cisco SD-WAN flaw exploited in zero-day attacks to gain root
- Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available
- Cisco SD-WAN 0-day exploited, no patch available (CVE-2026-20245)
- Cisco Warns of 7th SD-WAN Zero-Day Exploited in 2026
Detection coverage for TL-2026-0696
As of 2026-06-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0696 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.