Threat reportVulnerabilityTL-2026-1064
Cisco Catalyst SD-WAN Manager Zero-Day Exploitation Chain (CVE-2026-20245, CVE-2026-20127, CVE-2026-20182)
Cisco Catalyst SD-WAN Manager Zero-Day Exploitation Chain (TL-2026-1064) is a critical-severity software vulnerability scored CVSS 10, first published 2026-07-02. It is attributed to UAT-8616 with medium confidence, affects Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage), references 6 CVEs (CVE-2026-20245, CVE-2026-20127, CVE-2026-20182), maps to 19 MITRE ATT&CK techniques (T1005, T1016, T1046), and is covered by 9 detection rules and 32 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 6Referenced vulnerabilities
- Techniques
- 19MITRE ATT&CK
- Actors
- 1UAT-8616
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 32Indicators of compromise
Key facts for TL-2026-1064
- Threat ID
- TL-2026-1064
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution
- UAT-8616
- Attribution confidence
- MEDIUM
- Motivation
- ESPIONAGE
- Target sectors
- telecoms, dns service provider, government administration, criticalinfrastructure
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 32
Malware and tooling in Cisco Catalyst SD-WAN Manager Zero-Day Exploitation Chain
Malware and tooling: xmrig, AdaptixC2, KScan, Nimplant, Sliver - S0633
How Cisco Catalyst SD-WAN Manager Zero-Day Exploitation Chain works
Cisco Catalyst SD-WAN Controller/Manager/Validator are affected by three vulnerabilities that chain into full unauthenticated-to-root compromise: two CVSS 10.0 peering-authentication bypasses (CVE-2026-20127, CVE-2026-20182) in the vdaemon DTLS service, and a CVSS 7.8 file-upload command-injection flaw (CVE-2026-20245, CWE-116) that lets a netadmin-privileged attacker execute arbitrary commands as root via a crafted tenant CSV. The threat actor UAT-8616 (with infrastructure overlaps to Operational Relay Box networks) exploited this chain against a major service provider's SD-WAN management infrastructure from late 2025 through March 2026, planting a UID-0 backdoor account and running anti-forensic cleanup scripts, before Cisco's June 24, 2026 disclosure and June 12, 2026 patch release.
In June 2026 Cisco disclosed three critical vulnerabilities affecting Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart), Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage), and Cisco Catalyst SD-WAN Validator (formerly SD-WAN vBond) across all deployment types (On-Prem, Cloud, Cloud-Pro, and FedRAMP).
CVE-2026-20127 and CVE-2026-20182 (both CVSS 10.0, CWE-287 Improper Authentication) reside in the peering authentication mechanism used by the 'vdaemon' service over DTLS on UDP port 12346. A remote, unauthenticated attacker can send crafted peering requests to become a trusted peer of the target appliance without credentials. Once peered, the attacker can perform privileged operations including injecting an attacker-controlled SSH public key into the vmanage-admin account's authorized_keys file, enabling remote login to the NETCONF service (SSH/TCP 830) as vmanage-admin and issuance of arbitrary NETCONF commands to manipulate SD-WAN fabric configuration, insert rogue peers, and gain administrative control of the overlay network. CVE-2026-20127 has reportedly been exploited by threat actor UAT-8616 since at least 2023; CVE-2026-20182 exploitation was confirmed by Cisco in May 2026 and CISA identified evidence of exploitation beginning mid-April 2026.
CVE-2026-20245 (CVSS 7.8, CWE-116 Improper Encoding/Escaping of Output) is a CLI file-upload vulnerability. An authenticated attacker holding netadmin privileges (obtained legitimately or via the CVE-2026-20127/CVE-2026-20182 authentication-bypass chain) can run 'request tenant-upload tenant-list' to upload a crafted CSV file (observed as 'evil_tenant.csv') to the device. The file-upload feature fails to validate or filter the embedded shell metacharacters before the content is processed by privileged shell helper scripts, resulting in command injection executed as root. In the observed intrusion, the payload appended a rogue user 'troot' (UID/GID 0) to /etc/passwd and /etc/shadow, granting a fully privileged root shell reachable via 'su troot' from the compromised 'admin' account. Cisco confirmed limited real-world cases where exploitation of CVE-2026-20245 resulted in unauthorized configuration changes pushed to edge devices. No workaround exists for CVE-2026-20245; only upgrade remediates it.
Cisco Talos and Google Mandiant document a multi-phase intrusion against a major service provider's SD-WAN management plane: rogue peering connections established from late 2025 through January 2026 using CVE-2026-20127/CVE-2026-20182 while no patch was yet available; re-establishment of access in March 2026 via SSH using the vmanage-admin account and stolen certificate material, followed by temporary manipulation of the 'admin' web account password to browse device inventories, controller lists, and device configuration templates via the dataservice REST API, with the password reverted afterward to erase evidence; and finally, in April 2026, exploitation of CVE-2026-20245 to plant the 'troot' backdoor account. The actor then ran a self-verification/cleanup script that deleted the CSV payload and all backup artifacts and confirmed no trace of the backdoor account or modified files remained on disk — textbook anti-forensic tradecraft consistent with a well-resourced, likely state-sponsored operator conducting long-term strategic access to telecom/service-provider network infrastructure.
Separately, Cisco Talos also tracked at least 10 distinct lower-sophistication threat clusters exploiting related Catalyst SD-WAN Manager CVEs (CVE-2026-20133, CVE-2026-20128, CVE-2026-20122 — chained RCE, not part of this hunt's primary CVE set) using public proof-of-concept code from ZeroZenX Labs during March-April 2026, deploying JSP webshells (XenShell, Godzilla, Behinder variants), C2 frameworks (AdaptixC2, Sliver, Nimplant), scanning tools (KScan/QScan), tunneling utilities (gsocket), and XMRig cryptominers — illustrating that once a Catalyst SD-WAN RCE chain becomes public, opportunistic actors rapidly commoditize it against exposed management planes globally.
CISA added CVE-2026-20245 to the Known Exploited Vulnerabilities (KEV) catalog on June 9, 2026 with a federal remediation due date of June 23, 2026, and CVE-2026-20182 was also added to KEV following confirmed exploitation. CISA and partner agencies issued guidance for ongoing global exploitation of Cisco SD-WAN systems on February 25, 2026.
MITRE ATT&CK techniques used in TL-2026-1064
Collection
Discovery
T1016 System Network Configuration Discovery; T1046 Network Service Discovery
Defense Evasion
T1070 Indicator Removal; T1078 Valid Accounts
Command and Control
T1071 Application Layer Protocol; T1090 Proxy
Privilege Escalation
T1078 Valid Accounts; T1134 Access Token Manipulation; T1548 Abuse Elevation Control Mechanism
Persistence
T1098 Account Manipulation; T1136 Create Account; T1505 Server Software Component
Credential Access
T1110 Brute Force; T1552 Unsecured Credentials
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Impact
Lateral Movement
defense-impairment
Affected products and versions in Cisco Catalyst SD-WAN Manager Zero-Day Exploitation Chain
- Cisco — Catalyst SD-WAN Manager (formerly SD-WAN vManage)
Vulnerable versions: 20.9.9.1 and earlier; 20.12.7.1 and earlier; 20.15.4.4 and earlier; 20.15.5.2 and earlier; 20.18.3; 26.1.1.1 and earlier
Fixed in: 20.9.9.2; 20.12.7.2; 20.15.4.5; 20.15.5.3; 20.18.3.1; 26.1.1.2 - Cisco — Catalyst SD-WAN Controller (formerly SD-WAN vSmart)
Vulnerable versions: 20.9.9.1 and earlier; 20.12.7.1 and earlier; 20.15.4.4 and earlier; 20.15.5.2 and earlier; 20.18.3; 26.1.1.1 and earlier
Fixed in: 20.9.9.2; 20.12.7.2; 20.15.4.5; 20.15.5.3; 20.18.3.1; 26.1.1.2 - Cisco — Catalyst SD-WAN Validator (formerly SD-WAN vBond)
Vulnerable versions: 20.9.9.1 and earlier; 20.12.7.1 and earlier; 20.15.4.4 and earlier; 20.15.5.2 and earlier; 20.18.3; 26.1.1.1 and earlier
Fixed in: 20.9.9.2; 20.12.7.2; 20.15.4.5; 20.15.5.3; 20.18.3.1; 26.1.1.2
Remediation for Cisco Catalyst SD-WAN Manager Zero-Day Exploitation Chain
Patches
- Upgrade Cisco Catalyst SD-WAN Manager/Controller/Validator to 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, or 26.1.1.2 or later (remediates CVE-2026-20245, CVE-2026-20127, CVE-2026-20182)
Immediate actions
- Restrict management-plane access to Catalyst SD-WAN Controller/Manager/Validator to trusted management networks only; do not expose UDP/12346 (vdaemon), TCP/830 (NETCONF), or the web management interface to the internet
- Audit /var/log/auth.log for 'Accepted publickey for vmanage-admin' entries originating from unrecognized or unauthorized IP addresses
- Review /var/log/scripts.log for unexpected 'request tenant-upload tenant-list' invocations and unrecognized CSV filenames
- Run 'request admin-tech' and inspect for the rogue 'troot' account (UID/GID 0) in /etc/passwd and /etc/shadow
- Monitor for unauthorized peering connections and rogue vSmart/vBond/vManage peers not present in the authorized fabric inventory
- Review admin and vmanage-admin account password-change history for unexplained changes followed by reversion
Workarounds
- No workaround exists for CVE-2026-20245 per Cisco advisory cisco-sa-sdwan-privesc-4uxFrdzx; upgrade is the only remediation
- As a compensating control, restrict vdaemon (UDP/12346) and NETCONF (TCP/830) exposure until patched
Longer-term hardening
- Deploy network segmentation isolating SD-WAN control-plane and management-plane traffic from general internet-facing segments
- Implement continuous configuration-drift monitoring on edge device templates pushed from SD-WAN Manager
- Enable centralized, tamper-evident logging (forward auth.log/scripts.log off-box) to defeat on-host log/evidence deletion
- Establish a recurring SD-WAN infrastructure compromise-assessment cadence given the demonstrated multi-month dwell time
CVEs associated with Cisco Catalyst SD-WAN Manager Zero-Day Exploitation Chain
CVE-2026-20245, CVE-2026-20127, CVE-2026-20182, CVE-2026-20122, CVE-2026-20128, CVE-2026-20133
Weaknesses (CWE) in Cisco Catalyst SD-WAN Manager Zero-Day Exploitation Chain
Timeline of Cisco Catalyst SD-WAN Manager Zero-Day Exploitation Chain
- Cisco Talos identified UAT-8616 exploitation of CVE-2026-20127 dating back to at least 2023, predating public disclosure by years.
- Rogue peering connections established against a major service provider's SD-WAN Manager infrastructure, likely via CVE-2026-20127 or CVE-2026-20182 peering-authentication bypass.
- Close of the late-2025-through-January-2026 initial access window during which unauthorized peering connections were maintained; no patch was available.
- CISA and partner agencies released joint guidance on ongoing global exploitation of Cisco SD-WAN systems.
- Attacker re-established access via SSH as vmanage-admin using stolen certificate material, temporarily changed the 'admin' web account password, queried device/controller inventory and configuration templates via the dataservice REST API, then reverted the password to evade detection.
- Attacker exploited CVE-2026-20245 via 'request tenant-upload tenant-list /home/admin/evil_tenant.csv vpn 0', injecting the rogue root-level user 'troot' (UID/GID 0) into /etc/passwd and /etc/shadow.
- Cisco confirmed limited in-the-wild exploitation of CVE-2026-20182 authentication bypass; Rapid7 researchers Stephen Fewer and Jonah Burgess credited with discovery.
- CISA added CVE-2026-20245 to the Known Exploited Vulnerabilities catalog with a federal remediation due date of June 23, 2026.
- Cisco released fixed software (20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, 26.1.1.2) addressing CVE-2026-20245, credited to Google Mandiant researchers Chester Sng, Pete Boonyakarn, and Logeswaran Nadarajan.
- Cisco publicly disclosed the vulnerability chain and confirmed active zero-day exploitation against SD-WAN infrastructure.
- Google Cloud/Mandiant published detailed technical analysis of the exploitation chain, backdoor account creation, and anti-forensic cleanup activity observed against the compromised service provider.
Sources cited for Cisco Catalyst SD-WAN Manager Zero-Day Exploitation Chain
- Cisco Catalyst SD-WAN Manager 0-Day Vulnerability Actively Exploited
- Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited
- Cisco Security Advisory: Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator Authenticated Privilege Escalation Vulnerability
- Cisco Security Advisory: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
- Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager
- Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities
- Cisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited to Gain Admin Access
- Cisco SD-WAN Zero-Day CVE-2026-20127 Exploited Since 2023 for Admin Access
- CISA and Partners Release Guidance for Ongoing Global Exploitation of Cisco SD-WAN Systems
- CVE-2026-20182: Critical authentication bypass in Cisco Catalyst SD-WAN Controller (FIXED)
- CVE-2026-20127 Detail - NVD
- CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation
- Cisco SD-WAN Zero-Day: Unpatched Root Privilege Escalation
Detection coverage for TL-2026-1064
As of 2026-07-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1064 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.