This vulnerability in Cisco Catalyst SD-WAN Manager's CLI is caused by improper encoding or escaping of output, leading to insufficient validation of user-supplied input. An attacker with netadmin privileges can exploit this by uploading a crafted file, resulting in command injection and root privilege escalation. Exploitation requires authenticated local access with netadmin rights. Cisco has documented limited exploitation incidents affecting edge device configurations. Cisco recommends upgrading to the fixed software released on May 14, 2026.

Successful exploitation allows an attacker with netadmin privileges to execute arbitrary commands as root on the affected system, leading to full system compromise and potential unauthorized configuration changes pushed to edge devices. This elevates the attacker's privileges and control over the SD-WAN Manager environment, impacting confidentiality, integrity, and availability.

Cisco has released fixed software versions as of May 14, 2026, to address this vulnerability. Users should upgrade to the patched versions documented in Cisco's advisory and verify the configurations of edge devices for unauthorized changes. No other mitigation or temporary workaround is specified. Patch status is not explicitly confirmed in the provided data; therefore, users should consult Cisco's official advisory for the latest remediation guidance.