Cisco Catalyst SD-WAN Manager Zero-Day Exploited to Gain Root Access

A sophisticated intrusion campaign targeting SD-WAN infrastructure at a service provider, culminating in the exploitation of a previously unknown vulnerability to achieve root-level system access. The zero-day, now tracked as CVE-2026-20245, resides in the CLI of Cisco Catalyst SD-WAN Controllers and stems from the device’s file upload feature failing to properly filter malicious input data. […]

The post .