Cisco Catalyst SD-WAN Manager Privilege Escalation RCE (CVE-2026-20245) | MSSP Advisory

Risk Assessment

Cisco disclosed an unpatched zero-day in Catalyst SD-WAN Manager tracked as CVE-2026-20245 that allows local attackers with netadmin privileges to escalate to root by uploading a crafted file and injecting commands. Active exploitation has been confirmed by Mandiant, with observed cases where successful exploitation resulted in configuration changes being pushed to edge devices. No patch exists yet, and the vulnerability affects every deployment model including on-prem, cloud-managed, and FedRAMP environments.

If you manage client network infrastructure that includes Cisco Catalyst SD-WAN, a compromised SD-WAN Manager means an attacker with root on that system can push configuration changes to every edge device that manager controls, which is a single point of failure for your entire client WAN topology. On your own stack, if you use SD-WAN Manager to monitor multi-site clients from one dashboard, that dashboard is now an attacker-controlled pivot point into every client site it touches. Saying nothing to clients running this today is a contract liability, not just a retention risk.