Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available

Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available Ravie LakshmananJun 06, 2026Vulnerability / Network Security Cisco has warned that a high-severity security flaw impacting Catalyst SD-WAN Manager has come under active exploitation. The vulnerability, tracked as CVE-2026-20245, carries a CVSS score of 7.8 out of a maximum of 10.0. It affects the following deployment types - On-Prem Deployment Cisco SD-WAN Cloud-Pro Cisco SD-WAN Cloud (Cisco Managed) Cisco SD-WAN for Government (FedRAMP) "A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system," Cisco said in an advisory. The network security company said the vulnerability is the result of insufficient validation of user-supplied input, which an attacker could exploit by uploading a crafted file to the affected system. This, in turn, could permit the attacker to perform command injection attacks and elevate their privileges as the root user. "To exploit this vulnerability, the attacker must have netadmin privileges on the affected system," Cisco added. "This would require valid credentials or exploitation of CVE-2026-20182 or CVE-2026-20127. Cisco is not aware of successful exploitation by other methods." CVE-2026-20182 (CVSS score: 10.0) was disclosed last month by Rapid7, describing it as an authentication bypass that could enable unauthenticated, remote attackers to obtain administrative privileges on susceptible systems. It's also assessed to be similar to CVE-2026-20127, another case of authentication bypass impacting the same component. Both vulnerabilities have been exploited in the wild as zero-days, with a threat activity cluster dubbed UAT-8616 linked to the abuse of CVE-2026-20127 as far back as 2023. In its advisory released Thursday, Cisco said it observed limited cases where the exploitation of CVE-2026-20245 resulted in a configuration change pushed to edge devices. It credited Google Mandiant researchers Chester Sng, Pete Boonyakarn, and Logeswaran Nadarajan with discovering and reporting the new vulnerability. It is unknown who is behind the latest exploitation efforts. There are currently no patches or mitigations available for CVE-2026-20245. Customers are recommended to upgrade their SD-WAN software to ensure they have applied the fixes released for CVE-2026-20182 on May 14, 2026. Cisco has also warned that internet-exposed systems are at heightened risk of compromise. To look for indicators of compromise (IoCs), users are advised to check the "/var/log/scripts.log" file for entries like below - Apr 15 09:44:57 vmanage vScript: Tenant list upload per vsmart serial number: /usr/bin/vconfd_script_upload_tenant_list.sh -cli path /home/admin/malicious.csv vpn 0 Jun 5 13:06:39 Manager vScript: vSmart upload serial numbers: /usr/bin/vconfd_script_upload_vsmart_serial_numbers.sh -cli path /home/admin/vsmart_serial_numbers_safe.csv Jun 5 13:08:47 Validator vScript: ZTP upload chassis numbers: /usr/bin/vconfd_script_upload_chassis_number_file.sh -cli path /home/admin/chassis_numbers_safe.csv CVE-2026-20245 is the seventh flaw impacting Cisco SD-WAN to be flagged as active exploited this year alone after CVE-2026-20182, CVE-2026-20127, CVE-2026-20122, CVE-2026-20128, CVE-2026-20133, and CVE-2022-20775. The disclosure comes days after Cisco addressed another high-severity security flaw in Unified Communications Manager (CVE-2026-20230, CVSS score: 8.6), for which it said a proof-of-concept exploit code is public. There is no evidence that the vulnerability has come under active exploitation. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  cisco, Command Injection, cybersecurity, Incident response, Mandiant, network security, privilege escalation, SD-WAN, Vulnerability, Zero-Day ⚡ Top Stories This Week GlassWorm Malware Takedown Disrupts Developer Supply Chain Attack Infrastructure Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm OpenAI Codex Authentication Tokens Stolen in codexui-android npm Supply Chain Attack Oracle WebLogic CVE-2024-21182 Added to KEV Catalog After Active Exploitation PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites ChatGPhish Vulnerability Turns ChatGPT Web Summaries Into a Phishing Surface Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal Google June 2026 Android Update Patches 124 Flaws, One Actively Exploited Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit Malicious npm Package Stole Files From Claude AI User Directory via GitHub Dashlane Discloses Brute-Force Attack, Encrypted Vaults of Fewer Than 20 Users Downloaded ⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AI-Powered Attacks, OAuth Phishing and More ThreatsDay Bulletin: Claude Security Plugin, Azure Priv-Esc, Kali365 MFA Bypass, FIFA Scams +15 More Threat Actors Exploit Critical FortiClient EMS Flaw to Deploy Credential Stealer Load More ▼ ⭐ Featured Resources Your Employees Are Using AI in Ways You Can’t See – 2026 State of AI Report Watch AI Turn Vulnerabilities Into Working Exploits in Minutes (See the Demo) Learn How to Stop Attacks Before They Reach Your EDR – With PHASR [Guide] The Real Security Risks of Shadow AI (And Where You’re Exposed)