Cisco SD-WAN zero-day gives root access, the seventh exploited SD-WAN flaw this year
June 4, 2026 (June 4 to 25, 2026)
Cisco confirmed exploitation of CVE-2026-20245, a command-injection flaw in Catalyst SD-WAN Manager, Controller and Validator that lets an attacker who already has administrator-level access run commands as root. CISA added it to its list of known exploited vulnerabilities on June 4. Mandiant later reported it was used as a zero-day at least two months before disclosure, chained with earlier SD-WAN authentication flaws (CVE-2026-20127 and CVE-2026-20182). It is the seventh Cisco SD-WAN vulnerability exploited in 2026.
Why it matters
The SD-WAN management layer controls routing and policy for an entire network. Root access there lets an attacker reconfigure the devices at every site.
What defenders can take from it
- Keep management interfaces off the internet and patch the earlier SD-WAN flaws as well.
- Collect forensic data before upgrading, as Cisco advises, so evidence is not lost.