# Cisco Catalyst SD-WAN Manager Zero-Day Exploitation Chain (CVE-2026-20245, CVE-2026-20127, CVE-2026-20182)

> Cisco Catalyst SD-WAN Controller/Manager/Validator are affected by three vulnerabilities that chain into full unauthenticated-to-root compromise: two CVSS 10.0 peering-authentication bypasses (CVE-2026-20127, CVE-2026-20182) in the vdaemon DTLS service, and a CVSS 7.8 file-upload command-injection flaw (CVE-2026-20245, CWE-116) that lets a netadmin-privileged attacker execute arbitrary commands as root via a crafted tenant CSV. The threat actor UAT-8616 (with infrastructure overlaps to Operational Relay Box networks) exploited this chain against a major service provider's SD-WAN management infrastructure from late 2025 through March 2026, planting a UID-0 backdoor account and running anti-forensic cleanup scripts, before Cisco's June 24, 2026 disclosure and June 12, 2026 patch release.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1064
- **ID:** TL-2026-1064
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** UAT-8616
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20245, CVE-2026-20127, CVE-2026-20182, CVE-2026-20122, CVE-2026-20128, CVE-2026-20133

## Description

In June 2026 Cisco disclosed three critical vulnerabilities affecting Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart), Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage), and Cisco Catalyst SD-WAN Validator (formerly SD-WAN vBond) across all deployment types (On-Prem, Cloud, Cloud-Pro, and FedRAMP).

CVE-2026-20127 and CVE-2026-20182 (both CVSS 10.0, CWE-287 Improper Authentication) reside in the peering authentication mechanism used by the 'vdaemon' service over DTLS on UDP port 12346. A remote, unauthenticated attacker can send crafted peering requests to become a trusted peer of the target appliance without credentials. Once peered, the attacker can perform privileged operations including injecting an attacker-controlled SSH public key into the vmanage-admin account's authorized_keys file, enabling remote login to the NETCONF service (SSH/TCP 830) as vmanage-admin and issuance of arbitrary NETCONF commands to manipulate SD-WAN fabric configuration, insert rogue peers, and gain administrative control of the overlay network. CVE-2026-20127 has reportedly been exploited by threat actor UAT-8616 since at least 2023; CVE-2026-20182 exploitation was confirmed by Cisco in May 2026 and CISA identified evidence of exploitation beginning mid-April 2026.

CVE-2026-20245 (CVSS 7.8, CWE-116 Improper Encoding/Escaping of Output) is a CLI file-upload vulnerability. An authenticated attacker holding netadmin privileges (obtained legitimately or via the CVE-2026-20127/CVE-2026-20182 authentication-bypass chain) can run 'request tenant-upload tenant-list' to upload a crafted CSV file (observed as 'evil_tenant.csv') to the device. The file-upload feature fails to validate or filter the embedded shell metacharacters before the content is processed by privileged shell helper scripts, resulting in command injection executed as root. In the observed intrusion, the payload appended a rogue user 'troot' (UID/GID 0) to /etc/passwd and /etc/shadow, granting a fully privileged root shell reachable via 'su troot' from the compromised 'admin' account. Cisco confirmed limited real-world cases where exploitation of CVE-2026-20245 resulted in unauthorized configuration changes pushed to edge devices. No workaround exists for CVE-2026-20245; only upgrade remediates it.

Cisco Talos and Google Mandiant document a multi-phase intrusion against a major service provider's SD-WAN management plane: rogue peering connections established from late 2025 through January 2026 using CVE-2026-20127/CVE-2026-20182 while no patch was yet available; re-establishment of access in March 2026 via SSH using the vmanage-admin account and stolen certificate material, followed by temporary manipulation of the 'admin' web account password to browse device inventories, controller lists, and device configuration templates via the dataservice REST API, with the password reverted afterward to erase evidence; and finally, in April 2026, exploitation of CVE-2026-20245 to plant the 'troot' backdoor account. The actor then ran a self-verification/cleanup script that deleted the CSV payload and all backup artifacts and confirmed no trace of the backdoor account or modified files remained on disk — textbook anti-forensic tradecraft consistent with a well-resourced, likely state-sponsored operator conducting long-term strategic access to telecom/service-provider network infrastructure.

Separately, Cisco Talos also tracked at least 10 distinct lower-sophistication threat clusters exploiting related Catalyst SD-WAN Manager CVEs (CVE-2026-20133, CVE-2026-20128, CVE-2026-20122 — chained RCE, not part of this hunt's primary CVE set) using public proof-of-concept code from ZeroZenX Labs during March-April 2026, deploying JSP webshells (XenShell, Godzilla, Behinder variants), C2 frameworks (AdaptixC2, Sliver, Nimplant), scanning tools (KScan/QScan), tunneling utilities (gsocket), and XMRig cryptominers — illustrating that once a Catalyst SD-WAN RCE chain becomes public, opportunistic actors rapidly commoditize it against exposed management planes globally.

CISA added CVE-2026-20245 to the Known Exploited Vulnerabilities (KEV) catalog on June 9, 2026 with a federal remediation due date of June 23, 2026, and CVE-2026-20182 was also added to KEV following confirmed exploitation. CISA and partner agencies issued guidance for ongoing global exploitation of Cisco SD-WAN systems on February 25, 2026.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1110 Brute Force
- T1552 Unsecured Credentials
- T1548 Abuse Elevation Control Mechanism
- T1134 Access Token Manipulation
- T1078 Valid Accounts
- T1098 Account Manipulation
- T1505 Server Software Component
- T1136 Create Account
- T1578 Modify Cloud Compute Infrastructure
- T1070 Indicator Removal
- T1078 Valid Accounts
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1090 Proxy
- T1496 Resource Hijacking
- T1046 Network Service Discovery
- T1016 System Network Configuration Discovery

## Sources

- [Cisco Catalyst SD-WAN Manager 0-Day Vulnerability Actively Exploited](https://cybersecuritynews.com/cisco-catalyst-sd-wan-manager-0-day/)
- [Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited](https://thehackernews.com/2026/06/cisco-catalyst-sd-wan-manager-cve-2026.html)
- [Cisco Security Advisory: Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator Authenticated Privilege Escalation Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx)
- [Cisco Security Advisory: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW)
- [Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager](https://cloud.google.com/blog/topics/threat-intelligence/zero-day-exploitation-cisco-catalyst-sd-wan-manager)
- [Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities](https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/)
- [Cisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited to Gain Admin Access](https://thehackernews.com/2026/05/cisco-catalyst-sd-wan-controller-auth.html)
- [Cisco SD-WAN Zero-Day CVE-2026-20127 Exploited Since 2023 for Admin Access](https://thehackernews.com/2026/02/cisco-sd-wan-zero-day-cve-2026-20127.html)
- [CISA and Partners Release Guidance for Ongoing Global Exploitation of Cisco SD-WAN Systems](https://www.cisa.gov/news-events/alerts/2026/02/25/cisa-and-partners-release-guidance-ongoing-global-exploitation-cisco-sd-wan-systems)
- [CVE-2026-20182: Critical authentication bypass in Cisco Catalyst SD-WAN Controller (FIXED)](https://www.rapid7.com/blog/post/ve-cve-2026-20182-critical-authentication-bypass-cisco-catalyst-sd-wan-controller-fixed/)
- [CVE-2026-20127 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-20127)
- [CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation](https://thehackernews.com/2026/06/cisa-adds-cisco-chrome-and-arista-flaws.html)
- [Cisco SD-WAN Zero-Day: Unpatched Root Privilege Escalation](https://labs.cloudsecurityalliance.org/research/csa-research-note-cisco-sdwan-cve-2026-20245-zero-day-202606/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1064