# Cisco Catalyst SD-WAN Manager CVE-2026-20245 — Actively Exploited 0-Day: Authenticated File-Upload Command Injection to Root

> Cisco disclosed CVE-2026-20245, an actively exploited zero-day in Catalyst SD-WAN Manager (formerly vManage). Insufficient validation of an uploaded file in the CLI component lets an authenticated attacker with netadmin privileges inject and execute arbitrary OS commands as root. No patch or workaround is available; Mandiant reported in-the-wild exploitation and Cisco PSIRT observed cases where attackers pushed configuration changes to edge devices.

- **Published:** 2026-06-06T00:00:00Z
- **Last reviewed:** 2026-06-06T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0696
- **ID:** TL-2026-0696
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** UAT-8616
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20245, CVE-2026-20127, CVE-2026-20182

## Description

CVE-2026-20245 is a high-severity command-injection vulnerability (CVSS 3.1 base 7.8) in the command-line interface of Cisco Catalyst SD-WAN Manager, the centralized management plane (formerly branded vManage) for Cisco SD-WAN fabrics. The root cause is insufficient validation of user-supplied input contained in a file uploaded through the management interface. An attacker who already holds netadmin-level privileges can craft a file whose contents are passed into a privileged shell helper script, breaking out of the intended data context and injecting arbitrary operating-system commands that execute with root privileges on the underlying appliance.

The vulnerability is a privilege-escalation primitive rather than an initial-access primitive: it requires authenticated netadmin access. In observed activity, adversaries chained it with one of two SD-WAN Manager authentication-bypass flaws to first obtain the required role — CVE-2026-20182 (CVSS 10.0 authentication bypass, patched mid-May 2026) or CVE-2026-20127 (authentication bypass leveraged by sophisticated actors since 2023). Once netadmin is achieved, CVE-2026-20245 converts that web-tier foothold into full root control of the controller, from which the operator can read secrets, manipulate the SD-WAN control plane, and push malicious configuration to managed edge devices.

Exploitation abuses the legitimate vconfd helper scripts that vManage invokes to ingest operator-supplied data files (tenant lists, vSmart serial-number files, chassis-number files). These scripts are called with a path to the uploaded file; because the file's contents are not properly sanitized before being incorporated into a shell command line, malicious content is interpreted as commands. Forensic evidence appears in /var/log/scripts.log, where the helper invocations (for example a tenant-list upload referencing an attacker-controlled CSV path) are logged. Cisco PSIRT observed a limited number of successful cases in which exploitation resulted in configuration data being uploaded to vSmart controllers and configuration changes being propagated to edge devices, indicating intent to gain durable control over the routed fabric rather than mere host compromise.

All deployment models are affected: on-premises, Cisco SD-WAN Cloud-Pro, Cisco-managed SD-WAN Cloud, and the FedRAMP Cisco SD-WAN for Government offering. At disclosure (5 June 2026) no fixed software release and no workaround existed; Cisco directed customers to upgrade to releases that remediate CVE-2026-20182, to run 'request admin-tech' on control components to preserve forensic evidence before upgrading, to verify edge-device configurations, and to engage TAC for remediation of confirmed compromises. CVE-2026-20245 is the seventh actively exploited Cisco SD-WAN zero-day tracked in 2026, part of a sustained campaign against this widely deployed network-management infrastructure. The threat cluster UAT-8616, previously tied to exploitation of CVE-2026-20182 and CVE-2026-20127, is the leading candidate operator, though Cisco has not confirmed attribution for CVE-2026-20245 specifically.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1601 Modify System Image
- T1685.006 Clear Linux or Mac System Logs
- T1552 Unsecured Credentials
- T1021 Remote Services
- T1653 Power Settings

## Sources

- [Cisco Security Advisory cisco-sa-sdwan-privesc-4uxFrdzx](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx)
- [New Cisco SD-WAN flaw exploited in zero-day attacks to gain root](https://www.bleepingcomputer.com/news/security/new-cisco-sd-wan-flaw-exploited-in-zero-day-attacks-to-gain-root/)
- [Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available](https://thehackernews.com/2026/06/cisco-catalyst-sd-wan-manager-cve-2026.html)
- [Cisco SD-WAN 0-day exploited, no patch available (CVE-2026-20245)](https://www.helpnetsecurity.com/2026/06/05/cisco-sd-wan-cve-2026-20245-0-day-exploited/)
- [Cisco Warns of 7th SD-WAN Zero-Day Exploited in 2026](https://www.securityweek.com/cisco-warns-of-7th-sd-wan-zero-day-exploited-in-2026/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0696