Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager
MentionsCisco
Written by: Chester Sng, Pete Boonyakarn, Logeswaran Nadarajan, Lukasz Lamparski Introduction In early 2026, Mandiant identified a threat actor targeting SD-WAN infrastructure at a service provider. After gaining initial access, the threat actor exploited a zero-day vulnerability ( CVE-2026-20245 ) in Cisco Catalyst SD-WAN to escalate privileges from a compromised administrative account to root-level access.
Summary from Google Threat Intelligence.
Explained
The technology and terms in this story. Learn more
- ConceptZero-dayA flaw attackers exploit before the vendor has a fix: defenders have had zero days to patch.
- AttackPrivilege escalationGoing from limited access to more powerful access, such as from a normal user to administrator.
- ProtocolSSH · Secure ShellThe encrypted remote-login protocol administrators use to run commands on servers.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.