Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access
Summary: An unknown threat actor exploited CVE-2026-20245, a high-severity Cisco Catalyst SD-WAN flaw with a CVSS score of 7.8, as a zero-day at least two months before public disclosure, according to Mandiant. The attacker used a malicious CSV file upload (evil_tenant.csv) to escalate from a compromised admin account to root-level access at a communications service provider, creating a rogue account named 'troot' and deleting files and reversing configuration changes to cover their tracks.
Why it matters: Mandiant found two separate waves of unauthorized activity, one between late 2025 and January 2026 and another in March 2026, and could not determine whether the same actor was behind both. The attacker changed a default admin password, exfiltrated the SD-WAN fabric configuration, then changed the password back so an administrator logging in would notice nothing was off.
Read the original at The Hacker News ↗
- Topics
- Detection & Response
- Mentions
- CVE-2026-20127CVE-2026-20182CVE-2026-20245
- Related