Google's Mandiant team detailed the exploitation of CVE-2026-20245, a vulnerability in Cisco Catalyst SD-WAN infrastructure, in early 2026. This flaw allowed authenticated attackers to gain root privileges through the upload of a maliciously crafted file.

CVE-2026-20245 was exploited as a zero-day vulnerability months before its public disclosure in early June 2026. The flaw is a command injection vulnerability affecting the command-line interface (CLI) of Cisco Catalyst SD-WAN Manager, Controller, and Validator. Cisco released patches for the vulnerability approximately one week after its disclosure.

Mandiant's investigation into the exploitation began in early 2026 after an unidentified threat actor targeted SD-WAN infrastructure at a service provider. In March 2026, the attacker established initial access to the SD-WAN Manager instance via SSH, using the 'vmanage-admin' account. The attackers used this access to change the default admin account's password.

Mandiant reported that the threat actor then used their active 'vmanage-admin' session to revert the admin account's password to its original state before ending the session. "The threat actor subsequently used their active vmanage-admin session to change the password of the admin account back to its original state before terminating their active session," Mandiant stated. "This activity was likely performed to reduce the probability of detection by an administrator trying to log into the device during day-to-day operations." The researcher noted that "the vmanage-admin and admin accounts are default accounts on Cisco Catalyst SD-WAN controllers that have different privileges, but neither possesses root shell access."

The attackers exploited CVE-2026-20245 through a tenant-upload feature in the SD-WAN command-line interface by uploading a malicious CSV file named "evil_tenant.csv." This malicious payload created backups of system configuration files, including /etc/passwd and /etc/shadow. The attackers subsequently created a new account called "troot" with root-level privileges and used the Linux "su" command to switch from the compromised administrative account to the new root account.

Prior to the exploitation of CVE-2026-20245, Mandiant revealed that the intrusion began with unauthorized SD-WAN peering connections observed on the service provider's infrastructure. Beginning in March 2026, the threat actor established new rogue peer connections. Attackers logged into the SD-WAN Manager web interface and extracted configuration information for edge devices, controllers, and SD-WAN templates. Mandiant believes this rogue peering may have been created by exploiting CVE-2026-20127 and CVE-2026-20182, although Cisco told Mandiant researchers that the breach did not involve CVE-2026-20182.

The threat actor cleaned up traces of the exploitation by deleting the malicious CSV payload, removing temporary files, and erasing evidence of the rogue root account. Mandiant researchers observed the execution of a validation script to confirm all traces of the compromise had been removed from the device. "This campaign underscores the living off the edge paradigm, where threat actors prioritize the compromise of network appliances to bypass traditional security perimeters," Mandiant stated. "As organizations increasingly adopt software-defined networking, the orchestrators managing these environments become primary targets."

The exploitation of CVE-2026-20245 represents a security challenge within software-defined wide area network (SD-WAN) infrastructure. This incident is the seventh Cisco SD-WAN product flaw whose exploitation came to light in 2026. Cisco stated that the vulnerability stemmed from insufficient validation of user-supplied input and that no workarounds were available. Some incidents involved unauthorized configuration changes being pushed to edge devices, and Cisco suggested attackers might have used certificates from earlier compromises to regain access. Mandiant published indicators of compromise, attacker IP addresses, and guidance to help organizations determine if they were affected.