Cisco warns of unpatched SD-WAN zero-day exploited in attacks
Source Reddit Cybersecurity
Mentioned vulnerabilities
Rated by Threat Radar
Data as of 5 Jun 2026, 11:33 UTC
What to do
AI-suggested
As of the advisory date, no security patches are available for CVE-2026-20245. Cisco recommends monitoring the /var/log/scripts.log file for suspicious tenant configuration uploads indicative of exploitation attempts. Administrators should collect admin-tech files and open a case with Cisco TAC for assistance in investigating potential compromises. Cisco advises upgrading to fixed software versions for related vulnerabilities (CVE-2026-20182) to reduce attack surface. Organizations should ensure strict control of netadmin credentials and monitor for signs of credential compromise.
Discussion
Cisco has disclosed a critical, unpatched zero-day vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager that is actively exploited in the wild. The flaw allows local attackers with netadmin privileges to perform command injection attacks, leading to root privilege escalation by uploading crafted files. Exploitation requires valid credentials or prior exploitation of related vulnerabilities (CVE-2026-20182 or CVE-2026-20127). The vulnerability affects all deployment types of the product, including on-premises and cloud-managed versions. Cisco has not yet released a patch for this zero-day but advises monitoring for indicators of compromise and engaging Cisco TAC for incident response support. The vendor has released patches for related vulnerabilities but this specific flaw remains unpatched at this time.
r/cybersecurity (opens in a new tab)u/sunychoudhary0 points0 comments