CVE-2026-20245

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-20245 7.8

Cisco · Catalyst SD-WAN Manager · Added 2026-06-09

3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityCisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability

VendorCisco

ProductCatalyst SD-WAN Manager

Date added2026-06-09

Due date2026-06-23

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-116

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.

NVD: A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user. To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of other vulnerabilities. Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-26 03:41 UTC

Wall time0.5s

Searches4

Component defaultunknown

Sources https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx
https://cipherssecurity.com/cve-2026-20245-cisco-catalyst-sdwan-root/
https://cloud.google.com/blog/topics/threat-intelligence/zero-day-exploitation-cisco-catalyst-sd-wan-manager
https://securityarsenal.com/blog/cve-2026-20245-cisco-catalyst-sd-wan-manager-exploitation-detection-and-remediation-guide
https://github.com/fevar54/CVE-2026-20245---Cisco-SD-WAN-Privilege-Escalation-Exploit
https://thehackernews.com/2026/06/cisco-catalyst-sd-wan-manager-cve-2026.html

Hunting hypothesis agent

Hunt /var/log/scripts.log for vconfd_script_upload_tenant_list.sh outside maintenance, and /var/log/auth.log for SSH as vmanage-admin from external IPs followed by password changes and 'su troot' matching the Mandiant-observed attack.

Research details

ComponentCLI file upload handler (request tenant-upload tenant-list command) and the associated vconfd_script_upload_tenant_list.sh script

PreconditionsCisco Catalyst SD-WAN Manager, Controller (vSmart), and Validator (vBond) versions 20.9.x through 20.18.2.1, 20.12.7, and other specified release trains before 20.18.3.1 are affected. The attacker must have authenticated netadmin-level CLI access (typically via SSH as vmanage-admin or admin) to the affected SD-WAN controller device. The vulnerability is in the CLI file upload feature: the attacker executes 'request tenant-upload tenant-list /home/admin/evil_tenant.csv vpn 0' where evil_tenant.csv contains embedded shell commands. The vconfd_script_upload_tenant_list.sh script processes the CSV without proper input validation, allowing the embedded commands to execute as root. In observed in-the-wild exploitation (Mandiant), the attacker first established SSH access via rogue peering connections, changed the admin password, then uploaded a malicious CSV that appended a backdoor user 'troot' with root privileges to /etc/passwd and /etc/shadow. agent

DeliveryAuthenticated SSH session to the SD-WAN controller, followed by CLI command: request tenant-upload tenant-list /home/admin/evil_tenant.csv vpn 0. The malicious CSV contains embedded shell commands that back up original configuration files and append a root backdoor user ('troot:x:0:0:root:/root:/bin/bash') to /etc/passwd and a corresponding shadow entry to /etc/shadow. After exploitation, the attacker uses 'su troot' to access the root account.

Public PoCyes

PoC URLs https://github.com/fevar54/CVE-2026-20245---Cisco-SD-WAN-Privilege-Escalation-Exploit Third-party repos; verify before use.

Advisoryhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx

Exploit notesPublic PoC available on GitHub (fevar54/CVE-2026-20245) demonstrating authenticated privilege escalation via malicious CSV upload. CVSS attack complexity: LOW. Actively exploited in the wild as a zero-day; Mandiant identified a threat actor who gained initial access via unauthorized peering connections, authenticated via SSH, and exploited CVE-2026-20245 to escalate from admin to root by uploading evil_tenant.csv containing embedded shell commands that appended a backdoor user to /etc/passwd. The attacker employed extensive anti-forensic techniques: deleting the malicious CSV, restoring original configuration files, and running a validation script to confirm all indicators were purged. Fixed in versions 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, and 26.1.1.2.

SummaryCisco Catalyst SD-WAN Manager, Controller (vSmart), and Validator (vBond) contain a privilege escalation vulnerability (CVSS 7.8) in the CLI file upload feature. An authenticated attacker with netadmin privileges executes 'request tenant-upload tenant-list' with a crafted CSV file containing embedded shell commands. The vconfd_script_upload_tenant_list.sh script processes the CSV without proper input validation, allowing command injection as root. In-the-wild exploitation by a state-aligned threat actor involved rogue peering connections for initial access, SSH authentication, admin password manipulation for stealth, and a malicious CSV payload (evil_tenant.csv, SHA256: b82936f37648518425c7d3cf9e09eaffa41d7cdb3840f6a40287e3a108880f7b) that created a root backdoor user 'troot'. The attacker performed extensive anti-forensic cleanup, deleting all artifacts and restoring original files. Cisco advisory published May 14, 2026; CISA KEV added June 9, 2026.

Tia coverage

First reported2026-06-05

First exploit report2026-06-05

Exploit report → KEV4 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisco-sd-wan-manager-auth-bypass-cve-2026-76504-cvss-9-8-under-e

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.