Cisco Discloses Another Exploited SD-WAN Manager Zero-Day, CVE-2026-20245, With No Patch Yet and a Crafted File Path to Root
Cisco says CVE-2026-20245, a 7.8-rated command-injection flaw in Catalyst SD-WAN Manager, is being exploited to gain root. No patch or workaround is available; Mandiant reported it.
Overview
Cisco disclosed on June 5 that a new vulnerability in its Catalyst SD-WAN Manager has been exploited in zero-day attacks, and that no patch is yet available. The flaw, tracked as CVE-2026-20245, is described by the U.S. National Vulnerability Database as a vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, that could allow “an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system,” per NVD. NVD assigns the bug a base score of 7.8 HIGH, with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
The disclosure continues a run of SD-WAN advisories Cisco has issued in 2026. It follows the maximum-severity authentication bypass CVE-2026-20127 disclosed in February, as previously reported, and the second authentication bypass CVE-2026-20182 disclosed in May, as previously reported.
What We Know
The vulnerability is in the command-line interface of Catalyst SD-WAN Manager and stems from a validation weakness. According to SecurityWeek, Cisco said “This vulnerability is due to insufficient validation of user-supplied input.” An attacker exploits it by uploading a crafted file to the affected system, BleepingComputer reported.
Exploitation is not anonymous. To exploit the vulnerability, the attacker must have netadmin privileges on the affected system, according to Help Net Security, which described the attack path as: “Authenticated, local attackers can exploit it by uploading a crafted file to the affected system, and they can consequently execute arbitrary commands as root.” Cisco’s own summary of the impact, via BleepingComputer, is that “A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user.”
The vulnerability was reported to Cisco by Mandiant, SecurityWeek reported, a detail also noted by Help Net Security. Cisco’s Product Security Incident Response Team became aware of CVE-2026-20245 exploitation in June, per BleepingComputer. Help Net Security noted that Cisco has observed “limited cases where the exploitation of this bug resulted in a configuration change,” according to Help Net Security.
The flaw spans Cisco’s full SD-WAN footprint. It affects all Cisco SD-WAN deployment types — on-prem, Cloud-Pro, Cloud (Cisco Managed), and for Government (FedRAMP), according to Help Net Security.
No Patch Available
At disclosure, neither a fix nor a workaround was available. Help Net Security reported that “Cisco is still working on pushing out patches for CVE-2026-20245 and there are no available workarounds,” per Help Net Security. SecurityWeek reported that “Patches will be included in a future Catalyst SD-WAN Manager release and no workarounds are available,” according to SecurityWeek. The Register likewise reported that “A patch for this vulnerability will be provided on a future date,” per The Register.
Because exploitation requires netadmin access, that access can be obtained through stolen credentials or by chaining earlier SD-WAN flaws. BleepingComputer noted that prior bugs CVE-2026-20182 or CVE-2026-20127 could provide an entry point, per BleepingComputer. The Register reported a Cisco spokesperson saying “Cisco recommends customers upgrade to the fixed software released in May 2026 for CVE-2026-20182 as a protective measure,” according to The Register.
How Many SD-WAN Zero-Days This Year
Outlets differ on the precise tally. SecurityWeek framed the advisory as “yet another SD-WAN product vulnerability that has been exploited in the wild – the seventh whose exploitation was detected in 2026,” per SecurityWeek, and listed the others as CVE-2026-20182, CVE-2026-20127, CVE-2026-20128, CVE-2026-20122, CVE-2026-20133, and CVE-2022-20775. The Register instead called it “the sixth SD-WAN vulnerability listed as under attack since the start of the year, and the second zero-day in two months,” according to The Register. Either way, the count underscores a sustained focus on Cisco’s SD-WAN management plane through the first half of 2026.
What We Don’t Know
Cisco has not published a fixed-software release date for CVE-2026-20245, and the sources reviewed do not state when one will arrive. The scope of in-the-wild exploitation beyond the “limited cases” Cisco described is unclear, and the identity of the threat actors has not been disclosed in the reporting reviewed here. The specific affected and unaffected software versions were not enumerated in the sources cited.