Summary
Cisco has disclosed a critical zero-day vulnerability in Cisco Catalyst SD-WAN Manager (formerly vManage) that is being actively exploited by attackers. Tracked as CVE-2026-20245, the flaw allows authenticated attackers with low-level netadmin privileges to escalate to root access and execute arbitrary commands by uploading a specially crafted file through the CLI.
Google’s Mandiant threat intelligence team discovered the active exploitation and reported it to Cisco. The vulnerability impacts all SD-WAN deployment types — on-premises, Cloud-Pro, Cisco-managed cloud, and FedRAMP government instances. Cisco has confirmed observing limited cases where exploitation resulted in unauthorized configuration changes being pushed to edge devices, a particularly dangerous outcome in enterprise network environments.
No patch is currently available. Cisco recommends upgrading to the software version that fixes the related CVE-2026-20182 vulnerability as a temporary mitigation, and advises generating admin-tech files from each control component before upgrading to preserve forensic evidence. The company has also published indicators of compromise tied to attempts to upload tenant configuration data to vSmart controllers.
Sources
- BleepingComputer — New Cisco SD-WAN Flaw Exploited in Zero-Day Attacks
- Help Net Security — Cisco SD-WAN CVE-2026-20245 0-Day Exploited
- Cisco Security Advisory
Commentary
An actively exploited zero-day with no patch in a product that manages enterprise WAN infrastructure is about as bad as it gets. SD-WAN Manager sits at the control plane of an organization’s entire wide-area network — compromise here means attackers can push configuration changes to every edge device in the fleet, potentially rerouting traffic, opening backdoors, or disrupting connectivity across dozens of sites simultaneously.
The fact that Mandiant caught this in the wild rather than through bug bounty channels suggests sophisticated threat actors (possibly state-sponsored) are already leveraging it. Organizations running Cisco SD-WAN need to treat this as an emergency: apply the interim mitigation, audit logs for the published IOCs, and restrict netadmin access to the absolute minimum. Waiting for a proper patch while attackers have a head start is not a position anyone wants to be in.