Cisco SD-WAN Manager zero-day exploited to gain root, no patch yet

Cisco has warned of an actively exploited, unpatched zero-day in Cisco Catalyst SD-WAN Manager (CVE-2026-20245) that enables root privilege escalation across all deployment types, including on-prem, Cloud, Managed, and FedRAMP Government. The flaw stems from insufficient validation of user-supplied input: an attacker who uploads a crafted file can perform command injection and run arbitrary commands as root. Exploitation requires netadmin privileges - obtained via valid credentials or by chaining CVE-2026-20182 or CVE-2026-20127. Mandiant reported the activity to Cisco's PSIRT in June. Cisco has observed limited cases where exploitation pushed configuration changes to edge devices, and published IoCs pointing to suspicious tenant-list uploads in scripts.log.

Check

Inventory Cisco Catalyst SD-WAN Manager instances (all deployment types). Check /var/log/scripts.log for suspicious tenant-list uploads per Cisco's IoCs. Verify netadmin accounts and confirm CVE-2026-20182/20127 are patched.

Affected

All Cisco Catalyst SD-WAN Manager deployments (on-prem, Cloud, Managed, FedRAMP). Root-level command injection via crafted file upload; requires netadmin privileges, obtainable by chaining CVE-2026-20182 or CVE-2026-20127. No patch yet.

Fix

No patch available. Restrict netadmin access, enforce strong credentials and MFA, and patch the chainable CVE-2026-20182/20127. Apply Cisco IoCs and monitor scripts.log and edge-device config changes.