Critical Cisco SD-WAN Vulnerability CVE-2023-20252 Exploited in the Wild

Key Takeaways

• A critical vulnerability in Cisco Catalyst SD-WAN Manager, CVE-2026-20245, is being actively exploited in the wild.
• Attackers can achieve root-level command execution and privilege escalation, potentially compromising the entire SD-WAN management plane.
• The flaw affects all Cisco Catalyst SD-WAN Manager deployments, including on-premises and cloud versions.
• While a dedicated patch for this specific issue is pending, Cisco advises upgrading to a previously released fixed software version.
• The vulnerability requires authenticated access, but can be chained with other flaws for broader exploitation.

Cisco has confirmed active exploitation of a high-severity vulnerability, tracked as CVE-2026-20245, within its Catalyst SD-WAN Manager. This flaw enables attackers to execute arbitrary commands with root privileges, posing a significant risk to affected organizations.

The vulnerability, which carries a CVSS score of 7.8, stems from inadequate input validation in the system’s command-line interface. Specifically, Cisco’s advisory explains that the weakness lies in insufficient sanitization of user-supplied data during the processing of uploaded files.

An authenticated attacker can exploit this by uploading a specially crafted file. This action triggers a command injection, leading to privilege escalation and full root access on the compromised system. Attaining root access allows threat actors to fully compromise the SD-WAN management plane, manipulate configurations, and potentially impact connected edge devices. Exploitation of this vulnerability requires netadmin-level privileges, meaning unauthenticated individuals cannot directly leverage it.

Cisco SD-WAN Vulnerability Exploitation

Cisco warns that attackers may combine CVE-2026-20245 with other known vulnerabilities, such as CVE-2026-20182 or CVE-2026-20127, to gain the necessary initial access. This increases the real-world risk, particularly in environments where credential compromise or chained exploitation scenarios are plausible.

Cisco’s Product Security Incident Response Team (PSIRT) has verified that this vulnerability has already been exploited in a limited number of attacks. The observed incidents involved threat actors using the flaw to push unauthorized configuration changes to SD-WAN edge devices. Such activity suggests post-exploitation objectives, including establishing persistence, moving laterally within networks, or manipulating traffic flows.

The vulnerability impacts all deployments of Cisco Catalyst SD-WAN Manager, encompassing on-premises installations, Cisco SD-WAN Cloud, Cloud-Pro, and government (FedRAMP) deployments. Systems with internet exposure are at a heightened risk, especially if their management interfaces are externally accessible. At the time of this report, Cisco had not released a specific software patch to directly address this issue, nor were immediate workarounds available.

Cisco has advised customers to upgrade to a previously released fixed software version, as referenced in its May 2026 advisory. However, a dedicated fix for CVE-2026-20245 itself is still pending development.

Detection and Incident Response

Cisco has provided guidance to help organizations detect potential compromise. Administrators should examine the scripts.log file, located in /var/log/, for any suspicious entries. An example indicator includes the execution of commands like “/usr/bin/vconfd_script_upload_tenant_list.sh” with unexpected file paths, such as those associated with malicious CSV uploads. However, Cisco notes that these log entries can also appear during legitimate operations, necessitating careful analysis to prevent false positives.

For incident response purposes, organizations are strongly encouraged to collect forensic data using the “request admin-tech” command prior to applying any upgrades. This step is crucial for preserving vital evidence that can help determine the full extent of a compromise. Cisco also recommends reviewing device configurations and logs after upgrading, as patching alone may not fully remediate systems that have already been breached. Should indicators of compromise be identified, customers should contact Cisco TAC for guided remediation.

Simply upgrading affected systems without addressing any established persistence mechanisms or unauthorized changes could leave networks vulnerable. This vulnerability was reported by Mandiant, underscoring the importance of collaboration between vendors and threat intelligence teams in identifying and responding to active threats.

What You Should Do

• Upgrade Immediately: While a specific patch for CVE-2026-20245 is pending, upgrade to the latest fixed software version referenced in Cisco’s May 2026 advisory for general security improvements.
• Monitor Logs Actively: Regularly review the /var/log/scripts.log file for suspicious command executions, particularly those involving /usr/bin/vconfd_script_upload_tenant_list.sh with unusual file paths.
• Restrict Access: Ensure that SD-WAN management interfaces are not exposed to the public internet unless absolutely necessary, and enforce strict access controls.
• Collect Forensics: Before applying any upgrades or changes, use the “request admin-tech” command to gather forensic data for potential incident response.
• Post-Upgrade Verification: After upgrading, thoroughly review device configurations and logs to identify and undo any unauthorized changes or persistence mechanisms left by attackers. Engage Cisco TAC if signs of compromise are found.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.