● Covered by 1 source · 1 reportHigh impact
Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited for Root Access
Key points
- CVE-2026-20245 has a CVSS score of 7.8.
- Attackers need netadmin privileges to exploit this flaw.
- Exploitation involved anti-forensic techniques to evade detection.
Overview of the Vulnerability
CVE-2026-20245 is a high-severity vulnerability impacting Cisco Catalyst SD-WAN. It allows local, authenticated attackers to execute arbitrary commands by submitting crafted files due to insufficient validation of user input. The flaw has a CVSS score of 7.8, indicating its potential impact.
Exploitation and Attack Process
According to Mandiant, the vulnerability was exploited by a threat actor at least two months prior to public disclosure. Successful exploitation requires netadmin privileges, enabling the attacker to gain root access after changing default admin credentials and uploading a malicious CSV file named 'evil_tenant.csv'.
Attack Timeline and Methods
Two distinct waves of unauthorized activities have been identified: one occurring between late 2025 and January 2026, and another in March 2026. The first wave involved unauthorized peering connections exploiting other vulnerabilities, while the second wave targeted a device that had been patched against some exploits, suggesting advanced tactics by the threat actor.
Security Implications
The persistence and sophistication of the attacks highlight the vulnerabilities within Cisco Catalyst SD-WAN systems, particularly the risks associated with privileged access control. The ability of the attacker to use anti-forensic techniques suggests a pressing need for improved security measures in managing admin privileges.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
CVE CVE-2026-2012710.0 CRITICAL CVE CVE-2026-2018210.0 CRITICAL CVE CVE-2026-202457.8 HIGHReporting from
A zero-day vulnerability in Cisco Catalyst SD-WAN, tracked as CVE-2026-20245, has been exploited to gain root access by an unknown threat actor. This flaw, identified by Mandiant, allows an authenticated attacker to execute commands by manipulating user input, raising serious security concerns for affected systems.