Cisco Catalyst SD-WAN CVE-2026-20245 Actively Exploited, No Patch Available

Cisco has issued an urgent advisory confirming that a high-severity security flaw in its Catalyst SD-WAN Manager platform is under active exploitation in the wild, with no remediation patch currently available. The vulnerability, tracked as CVE-2026-20245 with a CVSS score of 7.8, affects the command-line interface (CLI) of Cisco Catalyst SD-WAN Manager across four deployment types: on-premises, SD-WAN Cloud-Pro, SD-WAN Cloud (Cisco Managed), and SD-WAN for Government (FedRAMP). According to the Cisco Security Advisory, the root cause is insufficient validation of user-supplied input within the CLI. An authenticated, local attacker can exploit this by uploading a specially crafted file to an affected system, enabling arbitrary command execution as the root user. The consequence is a full privilege escalation, allowing an attacker with netadmin-level access to assume complete control of the appliance. Cisco has confirmed the vulnerability is being actively exploited at the time of publication, with limited cases observed where exploitation resulted in unauthorised configuration changes being pushed to downstream edge devices. No patch has been released.

To exploit CVE-2026-20245, an attacker must already hold netadmin privileges on the affected system. Cisco has confirmed that this access can be obtained through valid credentials or through exploitation of two prior authentication bypass vulnerabilities: CVE-2026-20182, for which a fix was released on 14 May 2026, and CVE-2026-20127, which has been linked to a threat activity cluster designated UAT-8616 with exploitation dating back to 2023. Cisco states it is not aware of successful exploitation by any other method. The result is a documented chained attack path: an adversary who established initial access through either prior flaw and maintained persistence can proceed directly to root-level command execution through CVE-2026-20245 without requiring any additional external foothold.

Cisco has not released a dedicated patch for CVE-2026-20245. Until a fix is available, the company recommends the following interim actions:

Verify remediation of prior flaws. Ensure that CVE-2026-20182 and CVE-2026-20127 are fully patched across all affected SD-WAN Manager instances. These are the primary vectors through which attackers obtain the netadmin privileges required to exploit this vulnerability. The fix for CVE-2026-20182 was released on 14 May 2026 and should be applied immediately if not already done.

Restrict administrative access. Audit and strictly limit access to the SD-WAN Manager CLI and file upload functionality to a minimal set of trusted, multi-factor authenticated administrator accounts. Reducing the number of accounts with netadmin privileges directly reduces the exploitable attack surface.

Monitor for indicators of compromise. Audit system logs, specifically reviewing for unauthorised invocations of CLI scripts including vconfd_script_upload_tenant_list.sh, and flag any non-standard file upload activity across affected instances.

Verify edge device configuration. Review the configuration state of all downstream edge devices managed by affected SD-WAN Manager nodes to detect any unauthorised changes that may have been pushed by an already-compromised management instance.

GCC and MENA enterprise exposure

Cisco SD-WAN Manager is widely deployed across enterprise and government networks in the Gulf region, particularly in sectors managing distributed branch connectivity including banking, energy, retail, and public sector agencies. The active exploitation status elevates this from a patching task to an immediate incident response priority. Organisations running SD-WAN infrastructure should audit current CLI access privileges, ensure monitoring is in place for anomalous file upload activity, and engage Cisco TAC or their managed service provider immediately if the platform is internet-facing or accessible from less-trusted network zones. Security teams in Saudi Arabia and across the broader GCC should note that FedRAMP government-grade deployments are explicitly listed as affected, indicating the flaw is not limited to commercial environments. This is an evolving situation. Monitor Cisco's Security Advisory portal for patch availability.