Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager

Mandiant researchers detail a 2026 intrusion campaign targeting SD-WAN infrastructure at a service provider. The threat actor used unauthorized rogue peering connections for initial access, then exploited a zero-day vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager to escalate privileges from an admin account to root via a malicious CSV file upload. The exploit appended a backdoor root user ('troot') to /etc/passwd and /etc/shadow. The attacker also employed sophisticated anti-forensic techniques, including deleting malicious files, restoring original configurations, and running a validation script to confirm cleanup. Remediation guidance includes patching to specific fixed versions, IOC sweeps, and following Cisco's SD-WAN hardening guide. Detection rules and IOCs are provided for threat hunters.

Source: https://cloud.google.com/blog/topics/threat-intelligence/zero-day-exploitation-cisco-catalyst-sd-wan-manager. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.