NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

Cisco Catalyst SD-WAN CVE-2026-20245 exploited for root access; fixes available

Attackers used CVE-2026-20245 to take full control of Cisco SD-WAN management systems after gaining administrative access. Fixes are available. Business and family-office IT teams should upgrade and ask Cisco to check for compromise.

What to do

No home-device update is needed. If your business or family office uses Cisco SD-WAN, ask its IT provider to install the appropriate fixed release below, preserve diagnostic logs before upgrading, and involve Cisco TAC to check for compromise and unauthorised changes to connected routers.

What’s happening

CVE-2026-20245 affects Cisco Catalyst SD-WAN Manager, Controller and Validator, including on-premises and cloud deployments. An attacker who already has netadmin privileges can supply a malicious file and gain root access, the system’s highest level of control. This is not a flaw triggered by someone opening an ordinary email attachment. Mandiant observed exploitation at a service provider in April, before Cisco’s June disclosure; CISA listed it as exploited on 9 June. Cisco now provides fixed releases across the affected branches. Earlier authentication-bypass updates alone do not remove this flaw when an attacker holds valid credentials. Administrators must preserve diagnostic data and investigate possible compromise: updating does not by itself remove an existing intrusion. The reviewed sources do not establish that attacks have stopped.

What
Flaw
Affects
Cisco Catalyst SD-WAN Manager, Controller and Validator
Affected
Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage) and Validator (formerly vBond), regardless of configuration or deployment type
Cisco-listed affected releases: 20.9.9.1 and earlier; 20.12.7.1 and earlier; 20.15.4.4 and earlier; 20.15.5.2 and earlier; 20.18.2.2 and earlier; 20.18.3; 26.1.1.1 and earlier
Cisco's remediation guide also directs releases 20.16 and 20.17 to 20.18.3.1
Fixed in
20.9.9.2
20.12.7.2
20.15.4.5
20.15.5.3
20.18.3.1
26.1.1.2
20.15.507 — Cisco-hosted cluster deployments only
CVE
CVE-2026-20245
Since
4 June 2026
Closed
21 July 2026

Timeline

  1. Vendor revised

    Cisco clarified that 20.18.2.2 and earlier are affected, with 20.18.3.1 the fixed release.

  2. Vendor revised

    Cisco announced a Live Protect shield offering temporary, partial protection. Upgrading remained necessary.

  3. Update

    Mandiant reported that attackers at a service provider had exploited the flaw in April, after obtaining administrative access. They gained root access through a malicious CSV upload and removed evidence of their activity.

  4. New fixFixed

    Cisco added 20.9.9.2 and 20.12.7.2 and marked the advisory final, completing the listed fixes.

  5. New fixPartly fixed

    Cisco added fixed releases 20.15.4.5 and 20.15.5.3.

  6. New fixPartly fixed

    Cisco added fix availability for 26.1.1.2; fixes for other branches were still being completed.

  7. CISA added

    CISA added CVE-2026-20245 to its Known Exploited Vulnerabilities catalogue.

  8. Made public

    Cisco disclosed CVE-2026-20245 in Catalyst SD-WAN Manager.

Sources

  1. Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator Authenticated Privilege Escalation VulnerabilityCisco · 21 July 2026
  2. Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityCisco · 16 June 2026
  3. Remediate Catalyst SD-WAN Security Advisory - June 2026Cisco · 1 July 2026
  4. Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN ManagerMandiant · 24 June 2026
  5. Cisco security advisory (AV26-551) - Update 1Canadian Centre for Cyber Security · 9 June 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from June 2026 · JSON · RSS