Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager
Written by: Chester Sng, Pete Boonyakarn, Logeswaran Nadarajan
Introduction
In early 2026, Mandiant identified a threat actor targeting SD-WAN infrastructure at a service provider. After gaining initial access, the threat actor exploited a zero-day vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN to escalate privileges from a compromised administrative account to root-level access.
The vulnerability stems from the device’s file upload feature lacking the ability to properly filter malicious data.
Throughout the intrusion, to maintain operational security and avoid detection, the threat actor consistently employed anti-forensic techniques, selectively deleting and restoring system configuration files that were modified during their activities.
Key Observations
- Rogue Peering and Credential Manipulation: In March 2026, a threat actor established initial access via unauthorized peering connections to facilitate Secure Shell (SSH) access. The threat actor used that access to manipulate default account passwords to evade detection.
- Exploitation of CVE-2026-20245: Subsequently, the attacker leveraged a...
Copyright of this story solely belongs to google.com. To see the full text click HERE
