Loading story…
Mandiant reported that a threat actor compromised a service provider’s Cisco Catalyst SD-WAN environment by exploiting the zero-day vulnerability CVE-2026-20245 in Cisco Catalyst SD-WAN Manager. The flaw in the platform’s file upload functionality was abused through a malicious CSV upload, allowing the attacker to create a root-level account and take full control of the controller. After gaining SSH access through the vmanage-admin account, the actor changed the default admin password, logged into the web interface, and exfiltrated SD-WAN fabric configuration data.
The intrusion followed earlier unauthorized rogue peering activity observed from late 2025 into early 2026, which Mandiant assessed may have involved the then-undisclosed Cisco vulnerabilities CVE-2026-20127 or CVE-2026-20182. Additional peering activity in March 2026 may have relied on certificate material stolen during a prior compromise. Investigators said the attacker used extensive anti-forensic measures, including deleting malicious files, restoring altered system files, and checking that indicators of compromise had been removed, underscoring the risk posed by centralized SD-WAN controllers that manage trusted connections across distributed enterprise networks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Gurucul published eight IP address indicators, five file-path indicators, and three TDIR detection queries tied to the early-2026 exploitation of Cisco Catalyst SD-WAN Manager flaw CVE-2026-20245. The notice attributed the activity details to a Google Cloud threat intelligence blog post and provided defender-focused detection guidance.
Cisco released fixed software versions to remediate CVE-2026-20245 in Cisco Catalyst SD-WAN Manager. Mandiant and Cisco also advised organizations to hunt for indicators, collect admin-tech logs, and contact Cisco TAC if compromise is suspected.
Mandiant assessed that later peering activity in March 2026 may have relied on certificate material stolen during a prior compromise. This represented a subsequent phase of the broader intrusion activity against the Cisco SD-WAN environment.
After obtaining SSH access via the vmanage-admin account, the actor changed the default admin password, authenticated to the web interface, and exfiltrated SD-WAN fabric configurations. The intrusion also included anti-forensic actions such as deleting malicious files, restoring modified system files, and checking that indicators had been removed.
In an early 2026 intrusion, a threat actor exploited the zero-day vulnerability CVE-2026-20245 in Cisco Catalyst SD-WAN Manager’s file upload functionality. By uploading a malicious CSV, the actor created a root-level account and gained full control of the device.
Mandiant assessed that unauthorized peering activity targeting a service provider’s Cisco Catalyst SD-WAN infrastructure occurred from late 2025 through January 2026. The activity may have involved the then-undisclosed Cisco vulnerabilities CVE-2026-20127 or CVE-2026-20182.
CISA added Cisco Catalyst SD-WAN flaw CVE-2026-20245 to its Known Exploited Vulnerabilities catalog on 2026-06-04. It ordered Federal Civilian Executive Branch agencies to remediate or discontinue affected systems by 2026-06-23.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
thecyberexpress.com
Open sourcesecurityaffairs.com
Open sourcesecurityweek.com
Open sourcethehackernews.com
Open sourcemalware.news
Open sourcebleepingcomputer.com
Open sourcedarkreading.com
Open sourcecloud.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco and multiple government cyber agencies warned that attackers are actively exploiting **CVE-2026-20127**, a critical `CVSS 10.0` authentication bypass in **Cisco Catalyst SD-WAN Controller** and **Catalyst SD-WAN Manager**. The flaw affects the peering authentication process and lets unauthenticated remote attackers gain administrative access, use `NETCONF`, and alter SD-WAN fabric configuration, including adding **malicious rogue peers**. Cisco Talos attributed the activity to a sophisticated cluster tracked as **UAT-8616**, with evidence suggesting exploitation dates back to at least 2023 and has affected high-value targets, including critical infrastructure and government networks. Investigators said the intrusions often continued with a downgrade of the appliance software to exploit **CVE-2022-20775** for **root** privilege escalation, after which the original version was restored to help conceal the compromise while maintaining persistence. In response, **CISA** added both CVEs to the **Known Exploited Vulnerabilities** catalog and issued **Emergency Directive 26-03** for U.S. federal civilian agencies, while the **UK NCSC**, **ACSC**, **Canadian Centre for Cyber Security**, and other partners released joint hunting and hardening guidance. Cisco said there are **no complete workarounds**, urged immediate upgrades to fixed releases, and advised defenders to review peering events, SSH key activity, version history, and logs for signs of tampering or unauthorized access.
Jun 29, 2026
Cisco disclosed and patched **CVE-2026-20182**, a critical `CVSS 10.0` authentication bypass flaw in **Cisco Catalyst SD-WAN Controller** and **Cisco Catalyst SD-WAN Manager** that has been exploited in the wild. The bug affects the `vdaemon` control-plane service over **DTLS/UDP 12346** and allows an unauthenticated attacker to impersonate a trusted peer, gain high-privilege administrative access, reach **NETCONF** on `TCP/830`, and manipulate SD-WAN fabric configuration. Rapid7 said the flaw stems from missing authentication checks when a peer claims to be a vHub device, enabling attackers to inject SSH keys for the `vmanage-admin` account and establish persistent access; Cisco said there are **no workarounds** and released fixed software versions for affected on-premises, cloud, managed-cloud, and FedRAMP deployments. Cisco Talos attributed the most sophisticated exploitation of `CVE-2026-20182` with high confidence to **UAT-8616**, which was observed adding SSH keys, modifying NETCONF settings, and escalating privileges to root, with infrastructure overlap noted with Operational Relay Box networks. Talos also reported broader ongoing attacks against SD-WAN environments, including widespread exploitation of previously disclosed **CVE-2026-20133**, **CVE-2026-20128**, and **CVE-2026-20122** after public proof-of-concept release, leading to deployment of JSP webshells such as **XenShell**, **Godzilla**, and **Behinder**, along with tools including Sliver, AdaptixC2, XMRig, gsocket, and credential-stealing scripts. **CISA added CVE-2026-20182 to the KEV catalog** and ordered federal agencies to remediate quickly, while Cisco and national cyber agencies urged organizations to preserve forensic evidence, review logs for unauthorized peering and `vmanage-admin` public-key logins, and patch all vulnerable control components immediately.
Jun 29, 2026
Cisco disclosed active exploitation of **CVE-2026-20245**, a high-severity command injection flaw in **Cisco Catalyst SD-WAN Manager** that lets an authenticated attacker with `netadmin` privileges upload a crafted file and execute arbitrary commands as **root**. The vulnerability affects all deployment models, including on-premises, **Cisco SD-WAN Cloud**, Cloud-Pro, and FedRAMP environments, and Cisco said attackers have already used it in limited incidents to push unauthorized configuration changes to SD-WAN edge devices. Cisco said the flaw stems from insufficient validation and sanitization of user-supplied input in the CLI processing path, and warned that attackers may obtain the required privileges with valid credentials or by chaining previously disclosed bugs such as **CVE-2026-20182** or **CVE-2026-20127**. No dedicated patch or workaround was available at disclosure, so Cisco urged customers to upgrade to software versions that fix earlier exploited issues, review indicators of compromise such as suspicious entries in `/var/log/scripts.log`, preserve forensic evidence, collect diagnostics with the command: ```bash request admin-tech ``` and contact Cisco TAC if compromise is suspected.
Jun 29, 2026