Mandiant Uncovers Zero-Day CVE-2026-20245 Exploited in Cisco Catalyst SD-WAN Manager Attacks
Mandiant reveals a threat actor exploited CVE-2026-20245, a zero-day privilege escalation vulnerability in Cisco Catalyst SD-WAN Manager, to gain root access after breaching networks via rogue peering connections.
Mandiant has disclosed details of a sophisticated intrusion campaign targeting Cisco Catalyst SD-WAN infrastructure at a service provider, where attackers leveraged a previously unknown privilege escalation vulnerability, CVE-2026-20245, to escalate from a compromised administrative account to full root access on SD-WAN Manager devices.
The flaw resides in the file upload feature of Cisco Catalyst SD-WAN Manager, which fails to properly filter malicious data. By crafting a malicious CSV file, the attacker was able to upload it and trigger privilege escalation, granting root-level control over the management platform. This zero-day was exploited in early 2026, following initial access achieved through unauthorized peering connections.
Mandiant observed multiple rogue peering attempts from late 2025 through March 2026, some of which may have exploited two other critical vulnerabilities in Cisco Catalyst SD-WAN controllers: CVE-2026-20127 and CVE-2026-20182. Both of these flaws affect peering authentication and could allow unauthenticated remote attackers to bypass security and obtain administrative privileges. In at least one case, the attacker used stolen certificate material from a prior compromise.
Once inside, the threat actor authenticated via SSH using the vmanage-admin account, changed the default admin account password, and exfiltrated SD-WAN fabric configurations including device lists and templates. The attacker then exploited CVE-2026-20245 to achieve root access. Throughout the operation, the actor employed anti-forensic techniques—deleting malicious files, reverting configuration changes, and running validation scripts to ensure indicators of compromise were purged.
Cisco has since released patches for CVE-2026-20245, as well as for CVE-2026-20127 and CVE-6-20182. Customers are urged to update their Catalyst SD-WAN Manager and controller software immediately. CISA has not yet added CVE-2026-20245 to its Known Exploited Vulnerabilities catalog, but given active exploitation in the wild, organizations should prioritize patching.
The campaign underscores the growing appeal of SD-WAN infrastructure as a target for advanced threat actors. Because SD-WAN centralizes control of distributed networks, compromising the manager can give attackers visibility and control over traffic across hundreds or thousands of remote sites. The use of stolen certificates, password manipulation, and anti-forensic cleanup indicates a well-resourced and operationally disciplined adversary.
Mandiant noted that while the same threat actor may not be responsible for all observed rogue peering activity, the intrusion chain demonstrates a clear pattern: compromise the SD-WAN fabric through weak peering authentication, escalate privileges via the manager, then cover tracks to maintain persistent access. The full technical analysis is available on Mandiant's blog.
A new report from Cyber Security News details the recovery of a malicious CSV payload, named evil_tenant.csv, that was used to inject a root-level account (troot) by manipulating /etc/passwd and /etc/shadow. The threat actor also conducted a methodical cleanup, restoring backup configurations and deleting artifacts to evade detection. Indicators of compromise published with this article include eight IP addresses linked to rogue devices, spanning 45.32.38[.]160 and 207.190.37[.]94, among others, providing defenders with fresh IoCs for threat hunting.
Mandiant's latest report provides additional details on the attack, revealing that the threat actor exploited CVE-2026-20245 in March 2026 to create a rogue 'troot' account with root-level access at an unnamed communications service provider. The attackers also leveraged two other zero-days (CVE-2026-20127 and CVE-2026-20182) in an earlier wave, using unauthorized peering connections to gain initial footholds. Mandiant noted the attackers' extensive anti-forensic measures made it difficult to assess the full extent of the compromise, and Cisco has since released patches.
Mandiant's full technical report, published today, reveals the specific post-exploitation chain: after gaining initial access via rogue SD-WAN peering connections (possibly exploiting CVE-2026-20127 and CVE-2026-20182), attackers exploited CVE-2026-20245 by uploading a malicious CSV file named evil_tenant.csv through the tenant-upload feature. The payload created a hidden "troot" account with root privileges, backed up then restored /etc/passwd and /etc/shadow, and erased all traces of compromise including the malicious CSV and temporary files. Mandiant also observed a validation script that confirmed complete cleanup, while Cisco suggested certificate theft from a prior compromise may have enabled some of the unauthorized peering.
Dark Reading reports that Mandiant's investigation revealed the threat actor exploited CVE-2026-20245 as early as March 2026, two months before Cisco disclosed it on June 12. The attackers gained initial access via rogue BGP peering connections to the victim's SD-WAN Manager, likely chaining CVE-2026-20127 or CVE-6-20182, and after achieving root-level access, they deleted malicious files and reverted configuration changes in an extensive anti-forensic effort. CISA added the flaw to its KEV catalog on June 4, giving federal agencies until June 23 to patch.
SecurityWeek's report adds that Mandiant's investigation identified the attacker establishing initial access via SSH in March 2026 using the 'vmanage-admin' account, then exploiting CVE-2026-20245 to escalate to root. The threat actor also changed the admin password back to its original state after the attack to evade detection, and deleted all created files and restored altered configurations. Mandiant characterized the campaign as an example of the 'living off the edge' paradigm, where network appliances are targeted to bypass traditional perimeters.
Mandiant's detailed breakdown of the intrusion reveals that the attackers used a malicious CSV file (evil_tenant.csv) to trigger the privilege escalation and then created a hidden root account named 'troot'. The threat actor also meticulously covered their tracks by deleting files, reversing configuration changes, and even restoring the default admin password after exfiltration, according to Mandiant's analysis.
Mandiant's incident response report, published Wednesday, reveals that the attackers behind CVE-2026-20245 established rogue peering connections to the victim's SD-WAN environment, uploaded a malicious CSV file named evil_tenant.csv to trigger the privilege escalation, and created a hidden root account called 'troot.' The threat actor also demonstrated strong operational security by restoring modified credentials and configuration settings to their original state after exfiltrating SD-WAN configuration data, then deleting logs and running validation scripts to cover their tracks.