Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited
Summary: Cisco warned that CVE-2026-20245, a high-severity CLI flaw in Catalyst SD-WAN Manager with a CVSS score of 7.8, has come under active exploitation, allowing an authenticated local attacker with netadmin privileges to execute arbitrary commands as root by uploading a crafted file. Cisco said exploitation requires valid credentials or prior exploitation of CVE-2026-20182 or CVE-2026-20127, observed limited cases where exploitation pushed a configuration change to edge devices, and released updates for the flaw as of June 12, 2026.
What you should know: This is the seventh Cisco SD-WAN flaw flagged as actively exploited this year, and the threat cluster UAT-8616 has been abusing the related CVE-2026-20127 since 2023 - a track record that suggests the prior authentication bypasses are being chained into root-level access on edge devices.