{"id":"cisco-sdwan-root-access-jun-2026","category":"patch","status":"closed","title":"Cisco Catalyst SD-WAN CVE-2026-20245 exploited for root access; fixes available","tldr":"Attackers used CVE-2026-20245 to take full control of Cisco SD-WAN management systems after gaining administrative access. Fixes are available. Business and family-office IT teams should upgrade and ask Cisco to check for compromise.","summary":"CVE-2026-20245 affects Cisco Catalyst SD-WAN Manager, Controller and Validator, including on-premises and cloud deployments. An attacker who already has netadmin privileges can supply a malicious file and gain root access, the system’s highest level of control. This is not a flaw triggered by someone opening an ordinary email attachment. Mandiant observed exploitation at a service provider in April, before Cisco’s June disclosure; CISA listed it as exploited on 9 June. Cisco now provides fixed releases across the affected branches. Earlier authentication-bypass updates alone do not remove this flaw when an attacker holds valid credentials. Administrators must preserve diagnostic data and investigate possible compromise: updating does not by itself remove an existing intrusion. The reviewed sources do not establish that attacks have stopped.","action":"No home-device update is needed. If your business or family office uses Cisco SD-WAN, ask its IT provider to install the appropriate fixed release below, preserve diagnostic logs before upgrading, and involve Cisco TAC to check for compromise and unauthorised changes to connected routers.","product":"Cisco Catalyst SD-WAN Manager, Controller and Validator","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-20245"],"tags":["cisco","sd-wan","privilege-escalation","zero-day","actively-exploited"],"affected":["Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage) and Validator (formerly vBond), regardless of configuration or deployment type","Cisco-listed affected releases: 20.9.9.1 and earlier; 20.12.7.1 and earlier; 20.15.4.4 and earlier; 20.15.5.2 and earlier; 20.18.2.2 and earlier; 20.18.3; 26.1.1.1 and earlier","Cisco's remediation guide also directs releases 20.16 and 20.17 to 20.18.3.1"],"fixed":["20.9.9.2","20.12.7.2","20.15.4.5","20.15.5.3","20.18.3.1","26.1.1.2","20.15.507 — Cisco-hosted cluster deployments only"],"matches":[],"sources":[{"kind":"advisory","title":"Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator Authenticated Privilege Escalation Vulnerability","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx","by":"Cisco","date":"2026-07-21"},{"kind":"advisory","title":"Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW","by":"Cisco","date":"2026-06-16"},{"kind":"advisory","title":"Remediate Catalyst SD-WAN Security Advisory - June 2026","url":"https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/226014-remediate-catalyst-sd-wan-security.html","by":"Cisco","date":"2026-07-01"},{"kind":"research","title":"Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager","url":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-exploitation-cisco-catalyst-sd-wan-manager/?hl=en","by":"Mandiant","date":"2026-06-24"},{"kind":"advisory","title":"Cisco security advisory (AV26-551) - Update 1","url":"https://www.cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-551","by":"Canadian Centre for Cyber Security","date":"2026-06-09"}],"started":"2026-06-04","closed":"2026-07-21","created":"2026-11-03T22:19:08.211Z","updated":"2026-11-03T22:19:08.211Z","cve_notes":[{"cve":"CVE-2026-20245","name":"Command injection in Cisco SD-WAN control components","what":"Insufficient input validation in the command-line interface of Cisco Catalyst SD-WAN Manager, Controller and Validator lets an authenticated local attacker with netadmin privileges use a malicious file to run commands as root.","severity":"high","cvss":7.8}],"timeline":[{"at":"2026-07-21","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Cisco clarified that 20.18.2.2 and earlier are affected, with 20.18.3.1 the fixed release.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx","by":"Cisco","patch":null},{"at":"2026-07-15","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Cisco announced a Live Protect shield offering temporary, partial protection. Upgrading remained necessary.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx","by":"Cisco","patch":null},{"at":"2026-06-24","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Mandiant reported that attackers at a service provider had exploited the flaw in April, after obtaining administrative access. They gained root access through a malicious CSV upload and removed evidence of their activity.","url":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-exploitation-cisco-catalyst-sd-wan-manager/?hl=en","by":"Mandiant","patch":null},{"at":"2026-06-12","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Cisco added 20.9.9.2 and 20.12.7.2 and marked the advisory final, completing the listed fixes.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx","by":"Cisco","patch":"patched"},{"at":"2026-06-11","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Cisco added fixed releases 20.15.4.5 and 20.15.5.3.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx","by":"Cisco","patch":"partial"},{"at":"2026-06-10","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Cisco added fix availability for 26.1.1.2; fixes for other branches were still being completed.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx","by":"Cisco","patch":"partial"},{"at":"2026-06-09","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-20245 to its Known Exploited Vulnerabilities catalogue.","url":"https://www.cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-551","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-06-04","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Cisco disclosed CVE-2026-20245 in Catalyst SD-WAN Manager.","url":"https://www.cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-551","by":"Canadian Centre for Cyber Security","patch":null}],"url":"https://hard.fyi/live/cisco-sdwan-root-access-jun-2026/","json":"https://hard.fyi/api/live?id=cisco-sdwan-root-access-jun-2026"}