Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited for Root Access

In early 2026, attackers leveraged rogue peering to gain SSH access to a Cisco Catalyst SD-WAN Manager using the default vmanage-admin account, then exploited CVE-2026-20245—a local privilege‑escalation flaw in the SD‑WAN Manager CLI—to upload a malicious CSV file (evil_tenant.csv) that added a hidden troot account to /etc/passwd and /etc/shadow, achieving root. The incident, observed by Mandiant and Google GTIG, resulted in management‑plane compromise, configuration exfiltration, and anti‑forensic cleanup, highlighting SD‑WAN controllers as high‑value targets for persistent privileged access.

• Overview: Initial Compromise
• Rogue peering established SSH access via default vmanage-admin credential.

• Attacker changed admin password and exfiltrated controller configuration.

• Vulnerability Mechanics: CVE-2026-20245 Exploitation

• Local privilege‑escalation in SD‑WAN Manager CLI via crafted CSV upload.
• Command request tenant-upload tenant-list /home/admin/evil_tenant.csv vpn 0 appended troot to /etc/passwd and /etc/shadow.

• Resulted in root shell via su - troot.

• Impact and Active Exploitation

• CVSS 7.8 (High); root access enables traffic manipulation, hidden persistence, lateral movement.
• Observed in the wild against a service provider; anti‑forensic steps deleted logs and restored backups.

• Affected versions: all releases prior to fixed versions 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, 26.1.1.2+.

• Detection and Mitigation

• Monitor for unexpected troot account in /etc/passwd and /etc/shadow; review auth.log for su - troot.
• Verify integrity of /usr/share/viptela/vbond_vsmart_tenant_list and check for rogue CSV uploads.

• Apply Cisco patches; disable default vmanage-admin or enforce MFA/SSH key rotation; restrict CLI access to trusted networks.

• Conclusion and Recommendations

• Treat SD‑WAN controllers as critical assets; enforce least‑privilege and network segmentation.
• Regularly audit privileged accounts and configuration drift.
• Subscribe to Cisco PSIRT advisories and CISA alerts for timely patching.