Full Report
On Thursday, Cisco warned of a high-severity, unpatched zero-day in the Cisco Catalyst SD-WAN Manager (tracked as CVE-2026-20245) actively exploited in attacks enabling root privilege escalation. [...]
Analysis Summary
# Vulnerability: Cisco Catalyst SD-WAN Manager Root Privilege Escalation
## CVE Details
- **CVE ID:** CVE-2026-20245
- **CVSS Score:** High Severity (Score not explicitly listed in text, but categorized as "High-severity")
- **CWE:** CWE-77 (Improper Neutralization of Special Elements used in a Command - Command Injection) or CWE-20 (Improper Input Validation)
## Affected Systems
- **Products:** Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage)
- **Versions:** Impacted across all deployment modes; specific vulnerable version range not listed, but currently unpatched.
- **Configurations:**
- On-Prem Deployment
- Cisco SD-WAN Cloud-Pro
- Cisco SD-WAN Cloud (Cisco Managed)
- Cisco SD-WAN for Government (FedRAMP)
## Vulnerability Description
The flaw exists due to insufficient validation of user-supplied input when uploading files to the system. A local attacker can upload a specially crafted file to the manager software to perform a command injection attack. This allows the attacker to execute arbitrary commands with **root** privileges.
## Exploitation
- **Status:** Exploited in the wild (Zero-day)
- **Complexity:** Medium (Requires existing low-privilege access or "netadmin" privileges)
- **Attack Vector:** Local (Requires credentials or chaining with secondary vulnerabilities)
- **Note:** Cisco notes that exploitation currently requires the attacker to have `netadmin` privileges, likely obtained via valid credentials or by chaining this flaw with CVE-2026-20182 or CVE-2026-20127.
## Impact
- **Confidentiality:** High (Full system access)
- **Integrity:** High (Ability to push unauthorized configuration changes to edge devices)
- **Availability:** High (Potential for full system takeover or disruption)
## Remediation
### Patches
- **Status:** Not yet available. Cisco has not released a formal patch for CVE-2026-20245 as of the advisory date.
### Workarounds
- **Credential Security:** Ensure "netadmin" accounts use strong, unique passwords and multi-factor authentication to prevent the initial access required for this exploit.
- **Update Chained Vulnerabilities:** Upgrade to software versions that fix **CVE-2026-20182** (released May 14) and **CVE-2026-20127** to remove the primary vectors used to gain the necessary privileges for this attack.
## Detection
### Indicators of Compromise (IoC)
Admins should inspect `/var/log/scripts.log` for suspicious file uploads or tenant configuration updates.
- **Example Log Entry:**
`vScript: Tenant list upload per vsmart serial number: /usr/bin/vconfd_script_upload_tenant_list.sh -cli path /home/admin/[FILENAME].csv vpn 0`
### Detection methods and tools
- **Log Analysis:** Monitor for unauthorized `vconfd_script_upload_tenant_list.sh` executions.
- **Incident Response:** Generate an `admin-tech` file and contact the Cisco Technical Assistance Center (TAC) for forensic review.
## References
- Cisco Security Advisory: hxxps[://]sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx
- NVD Detail: hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-20245
- Original Report: hxxps[://]www[.]bleepingcomputer[.]com/news/security/cisco-warns-of-unpatched-sd-wan-zero-day-exploited-in-attacks/