Cisco SD-WAN Zero-Day Exploited Months Before Patching

Summary

Mandiant detailed the exploitation of Cisco Catalyst SD-WAN Manager vulnerability CVE-2026-20245, which was used as a zero-day for months before Cisco released patches in June 2026. An unidentified threat actor used the flaw to escalate privileges to root on SD-WAN Manager instances, potentially targeting service providers. The attackers also manipulated credentials and deleted evidence to evade detection.

Full text

Google’s Mandiant team has detailed the exploitation of a Cisco Catalyst SD-WAN vulnerability that was exploited as a zero-day months prior to its disclosure. The vulnerability, tracked as CVE-2026-20245, is the 7th Cisco SD-WAN product flaw whose exploitation came to light in 2026. CVE-2026-20245 affects the CLI of Cisco Catalyst SD-WAN Manager and allows an authenticated local attacker to execute arbitrary commands with root privileges using specially crafted files. The security hole was disclosed by Cisco in early June, and patches were released roughly one week later. Mandiant’s investigation began in early 2026 after observing an unidentified threat actor targeting SD-WAN infrastructure at a service provider. The attacker established initial access to an SD-WAN Manager instance via SSH in March 2026. They then exploited CVE-2026-20245 to escalate privileges to root.Advertisement. Scroll to continue reading. According to Mandiant, the same victim’s SD-WAN Manager systems were previously targeted — either by the same or a different threat actor — possibly through the exploitation of other vulnerabilities, CVE-2026-20127 or CVE-2026-20182, which at the time were also zero-days. In the March attack, the hackers authenticated to the SD-WAN Manager instance via SSH using the ‘vmanage-admin’ account and then used that access to change the default admin account’s password. “The threat actor subsequently used their active vmanage-admin session to change the password of the admin account back to its original state before terminating their active session. This activity was likely performed to reduce the probability of detection by an administrator trying to log into the device during day-to-day operations,” Mandiant explained. It added, “The vmanage-admin and admin accounts are default accounts on Cisco Catalyst SD-WAN controllers that have different privileges, but neither possesses root shell access.” Once they had admin privileges to the targeted system, the attacker exploited CVE-2026-20245 to escalate privileges and achieve full root-level access. In an effort to evade detection, the threat actor deleted all files created during the attack, restored altered system configurations, and ran a script to ensure no evidence remained. “This campaign underscores the living off the edge paradigm, where threat actors prioritize the compromise of network appliances to bypass traditional security perimeters. As organizations increasingly adopt software-defined networking, the orchestrators managing these environments become primary targets.” Mandiant said. Additional technical details and IoCs are available in Mandiant’s blog post. Separately, a cybersecurity firm has reported seeing attacks exploiting CVE-2026-20230, a Cisco Unified CM vulnerability patched in early June. However, Cisco told SecurityWeek that it cannot confirm in-the-wild exploitation as of June 24. Related: Cisco Patches Another SD-WAN Zero-Day, the Sixth Exploited in 2026 Related: Critical Ubiquiti Vulnerabilities in Attackers’ Crosshairs Related: FFmpeg PixelSmash Flaw Allows RCE on Video Players, Media Servers, NAS Appliances Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs Hackers Exploiting Cisco Unified CM VulnerabilityDragos Unveils AI for OT Security Algerian Man Extradited to US for Running Cybercrime MarketplacesTrump Signs Executive Order Accelerating Post-Quantum Cryptography Migration Xsolis Data Breach Affects 1.4 Million IndividualsDecades-Old Squid Proxy Flaw ‘Squidbleed’ Can Expose User DataNew Exploit Bypasses Apple’s Boot Defenses, Affects Millions of iPhonesTexas Parks & Wildlife Data Breach Affects 3 Million Individuals Latest News Chrome 149 Update Resolves 18 Severe VulnerabilitiesWhen Information Becomes the Attack Surface – Understanding AI Agent TrapsMicrosoft and Allies Smash Shared Infrastructure of Amadey and StealC MalwareExclusive: Meet AIVEX, a New Triage Model Built to Reduce Supply Chain Threat and RiskmacOS Weaknesses Chained to Silently Disable Endpoint Security AgentsThird DraftKings Hacker Sentenced to 18 Months in PrisonCritical Ubiquiti Vulnerabilities in Attackers’ CrosshairsAgentic AI Security: Wrong Context, Wrong Decisions at Machine Speed Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: How Modern Breaches Bypass MFA and Evade Detection June 17, 2026 Today’s attackers are no longer breaking in — they’re logging in. Join this live webinar as we break down the modern identity attack chain and examine how recent breaches exploited weaknesses in authentication, identity verification, and access management processes. Register Webinar: Modern Exposure Validation in the AI Era June 24, 2026 AI has accelerated both sides of the fight. Adversaries are weaponizing vulnerabilities faster, while defenders are racing to ship detections and configurations. Join this live webinar as we explore how to prove your controls actually hold against new threats, map your security maturity, and unite breach simulation with automated pentesting into a single, coordinated program. Register People on the MoveFable Security has appointed Jacob Berry as Chief Information Security Officer.iCOUNTER has named Ali Waezzadah as Chief Information Security Officer.Roger Hale has joined 1Kosmos as Chief Information Security Officer.More People On The MoveExpert Insights When Information Becomes the Attack Surface – Understanding AI Agent Traps From hidden content injections to cognitive state poisoning, attackers are turning trusted data sources into traps for autonomous AI. (Etay Maor) What the Latest ShinyHunters Breaches Reveal About Modern Cyberattacks Groups like ShinyHunters are demonstrating that attackers do not necessarily need malware or zero-day exploits to cause massive damage. (Torsten George) No Exploits Required Four decades of incident response experience suggest that exploits are often the symptom, not the root cause, of today’s cybersecurity failures. (Tod Beardsley) After AI Reaches Production: 12 Ways Security Teams Can Take Control Security teams need more than visibility into AI applications, they need a repeatable framework for monitoring, investigating, and defending them in production. (Joshua Goldfarb) Everybody Is Vibe Coding But Nobody Told the Security Team AI-driven development is not something organizations can or should block. But it must be governed. (Danelle Au) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2026-20245
• cve — CVE-2026-20127
• cve — CVE-2026-20182
• cve — CVE-2026-20230

Entities