CVE-2026-20245 is a critical zero-day vulnerability in Cisco Catalyst SD-WAN Manager that enables local attackers with netadmin privileges to escalate to root by exploiting insufficient validation of user-supplied input. Attackers can upload specially crafted files to trigger command injection and execute arbitrary commands as root. Exploitation requires either valid netadmin credentials or prior exploitation of other zero-days (CVE-2026-20182 or CVE-2026-20127). The vulnerability impacts all deployment types of Cisco SD-WAN Manager, including on-premises and cloud-managed environments. Cisco is aware of active exploitation but has not yet released a patch. Administrators are advised to check logs for suspicious tenant configuration uploads and contact Cisco TAC for assistance.

Successful exploitation allows attackers with netadmin privileges to execute arbitrary commands as root on affected Cisco Catalyst SD-WAN Manager systems, potentially leading to full system compromise and unauthorized configuration changes pushed to edge devices. The vulnerability affects all deployment types, increasing the scope of impact. Exploitation requires prior access or credential compromise, limiting attack vectors to those with some level of system access or who have exploited related vulnerabilities. Cisco has observed limited cases of exploitation resulting in configuration changes, indicating active targeted attacks.

As of the advisory date, no security patches are available for CVE-2026-20245. Cisco recommends monitoring the /var/log/scripts.log file for suspicious tenant configuration uploads indicative of exploitation attempts. Administrators should collect admin-tech files and open a case with Cisco TAC for assistance in investigating potential compromises. Cisco advises upgrading to fixed software versions for related vulnerabilities (CVE-2026-20182) to reduce attack surface. Organizations should ensure strict control of netadmin credentials and monitor for signs of credential compromise. Patch status is not yet confirmed for this zero-day — check Cisco's official advisory regularly for updates on remediation.