Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager

Why It Matters

The exploit shows SD‑WAN orchestrators are high‑value, low‑visibility targets, giving attackers persistent control over enterprise traffic. Prompt patching and hardening are essential to prevent similar zero‑day compromises.

Key Takeaways

• Threat actor leveraged CVE‑2026‑20245 to gain root on SD‑WAN Manager.
• Exploit used malicious CSV upload to create privileged “troot” user.
• Attackers performed rogue peering and changed default admin passwords.
• Extensive anti‑forensic cleanup erased files and restored configs.
• Cisco released patches; immediate upgrade to fixed versions required.

Pulse Analysis

Software‑defined WANs have become the backbone of modern enterprises, replacing legacy routers with centrally managed, cloud‑ready fabrics. While this shift improves agility, it also concentrates risk: a single compromised controller can expose traffic across dozens of branch sites. Over the past few years, threat actors have increasingly targeted network appliances, exploiting the limited visibility and telemetry these devices provide. The CVE‑2026‑20245 incident underscores how a seemingly innocuous file‑upload feature can become a gateway to full system takeover when proper input validation is absent.

The Cisco Catalyst SD‑WAN Manager flaw hinged on a crafted CSV payload that the CLI accepted without sanitization. By uploading the file, the attacker backed up critical system files, injected a new user with UID 0, and then used the default admin accounts to pivot to the newly created “troot” account. After achieving root, the adversary executed anti‑forensic actions—deleting the malicious CSV, restoring original configuration files, and running validation scripts to confirm no traces remained. This living‑off‑the‑edge approach blends legitimate administrative commands with malicious intent, making detection difficult for traditional security tools that focus on external malware.

Cisco’s rapid release of patches across several software branches reflects the urgency of hardening SD‑WAN infrastructures. Organizations should prioritize updating to the fixed versions, enforce strict access controls on peering certificates, and implement continuous monitoring of privileged account activity. Deploying file‑integrity monitoring, logging all tenant‑upload commands, and conducting regular IOC sweeps can surface hidden compromises. As SD‑WAN adoption accelerates, vendors and operators must treat the control plane as a critical asset, applying defense‑in‑depth strategies to mitigate future zero‑day exploits.