CVE-2026-20245

This is a bug in the command interface of Cisco’s SD-WAN management/controller software. If someone already has a strong administrator role (netadmin) and can access the system locally (for example via SSH), they can upload a crafted file that tricks the system into running commands with full “root” power.

Real attackers have used it to take over devices and then change network settings—while trying to hide traces.

This matters if your business runs Cisco Catalyst SD-WAN Manager or Cisco Catalyst SD-WAN Controller (including the formerly named SD-WAN vManage/vSmart components). The weakness requires an attacker to already have netadmin privileges on the affected system, meaning it’s primarily a risk when attackers have obtained valid admin access.

It’s a risk only if someone with netadmin-level access can reach the system (for example via SSH), and especially if that account could be compromised from the internet or via an admin-access path.

This is RED because it’s confirmed to be exploited in real attacks (CISA KEV) and attackers have already used it as a zero-day for root privilege escalation. Once attackers gain netadmin access, they can convert that into full control and actively try to evade detection.

1. Confirm exposure

   • Inventory the installed Cisco Catalyst SD-WAN software instances: catalyst sd-wan manager and catalyst sd-wan controller.
   • Record each instance’s exact software version.
   • Verify whether any administrator accounts used for SSH have netadmin privileges.

2. Compare versions to the fix

   • Treat any version earlier than 20.9.9.1 on catalyst sd-wan manager and sd-wan vsmart controller as potentially vulnerable.
   • Upgrade both Catalyst SD-WAN Manager and SD-WAN vSmart Controller to 20.9.9.1.

3. Upgrade plan (minimize downtime)

   • Schedule upgrades during a maintenance window if your SD-WAN manager/controller availability is critical.
   • Follow Cisco’s remediation guidance from the published Cisco Security Advisories.

4. Post-upgrade verification (important because of observed incident behavior)

   • Check whether edge devices received unexpected configuration changes (Cisco observed limited cases where exploitation pushed changes to edge devices).
   • Re-check SD-WAN configuration state against known-good baselines (templates, policy rules, and expected admin settings).

5. Hunt for signs of compromise

   • Review SSH/admin logins for the relevant period reported in real exploitation (initial reports were in early 2026, with activity starting at least in March 2026).
   • Look for evidence of anti-forensic behavior (for example, unexpected or missing configuration files) and unusual admin commands around the time of new account/password changes.

6. Temporary workaround if you cannot patch immediately

   • Reduce the chance of an attacker reaching netadmin-capable access paths: restrict SSH management access to trusted networks/allowlists and ensure admin accounts are tightly controlled.
   • If mitigations are available via Cisco guidance, implement them as directed; otherwise, consider discontinuing use of the product if Cisco/CISA guidance indicates mitigations are unavailable.

7. Reporting and monitoring

   • If compromise indicators are found, engage your incident response process and preserve logs.
   • Continue monitoring for persistence (new/changed admin accounts, repeated admin attempts, configuration drift).

Severity and risk: The issue enables authenticated local privilege escalation to root (CWE-116) and includes arbitrary command execution as root after a netadmin-level user supplies a crafted file. This is not just information leakage; it can fully compromise the management/controller system.

Exploitation status: CISA KEV lists CVE-2026-20245, added on 2026-06-09, with a remediation due date of 2026-06-23. News reporting confirms exploitation in the wild, including authenticated SSH exploitation using the vmanage-admin account, password changes, and anti-forensic tactics (selectively deleting/restoring configuration files).

Attack vector and mechanism: The attacker must have netadmin privileges and can trigger the flaw by uploading a crafted file to the affected system, leading to command injection and root privilege escalation. User interaction is none once the attacker has the required access.

Fix: Cisco provides fixed software version 20.9.9.1 for both catalyst sd-wan manager and sd-wan vsmart controller. The public exploit availability and KEV status together indicate an immediate, actionable threat.

What KEV means here: Being in CISA KEV means the vulnerability is confirmed to have been exploited in the wild, so organizations should prioritize patching/mitigations over typical risk-based prioritization.