Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager
MentionsCisco
Written by: Chester Sng, Pete Boonyakarn, Logeswaran Nadarajan, Lukasz Lamparski Introduction In early 2026, Mandiant identified a threat actor targeting SD-WAN infrastructure at a service provider. After gaining initial access, the threat actor exploited a zero-day vulnerability ( CVE-2026-20245 ) in Cisco Catalyst SD-WAN to escalate privileges from a compromised administrative account to root-level access.
Summary from Google Threat Intelligence.
Explained
The technology and terms in this story. Learn more
- ConceptZero-dayA flaw attackers exploit before the vendor has a fix: defenders have had zero days to patch.
- AttackPrivilege escalationGoing from limited access to more powerful access, such as from a normal user to administrator.
- ProtocolSSH · Secure ShellThe encrypted remote-login protocol administrators use to run commands on servers.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.