Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager

Mandiant reported June 24, 2026 that a threat actor exploited a zero-day vulnerability tracked as CVE-2026-20245 in Cisco Catalyst SD-WAN Manager. In early 2026 the actor targeted SD-WAN infrastructure at a service provider. After gaining initial access, the actor used the flaw to escalate privileges from a compromised administrative account to root-level access. The vulnerability exists in the command-line interface of Cisco Catalyst SD-WAN Controllers and allows an authenticated local attacker to execute arbitrary commands as root