CVE-2026-20245: Cisco Catalyst SD-WAN Manager privilege escalation in CLI

CVE-2026-20245 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2026-06-04

Cisco Catalyst SD-WAN Manager, a centralized management platform for enterprise networks, contains a security flaw that allows an authorized user to take full control of the system. By uploading a specially crafted file, an attacker with existing network administrator credentials can gain root-level access, potentially allowing them to alter network configurations or disrupt traffic across connected edge devices. Cisco has reported that this vulnerability has been exploited in the wild to push unauthorized configuration changes to network hardware.

Technologies: Cisco Catalyst SD-WAN Manager. Vendors: Cisco.

Quick answers

Is CVE-2026-20245 exploited in the wild?
Yes. CVE-2026-20245 is known to be exploited in the wild, first recorded on 9 June 2026. Treat it as urgent.
How severe is CVE-2026-20245?
Critical severity, with a CVSS score of 7.8, published 4 June 2026.
Which products and versions are affected?
Cisco Catalyst SD-WAN Manager All versions prior to May 14, 2026 fix, All versions prior to May 14, 2026 fix release.
Is there a fix for CVE-2026-20245?
A patch was published on 2026-05-14: Fixed software documented in Cisco advisory Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20245 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-20245?
Check whether you run Cisco Catalyst SD-WAN Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in the Command Line Interface (CLI) of Cisco Catalyst SD-WAN Manager (formerly vManage) stems from improper encoding or escaping of output (CWE-116) and insufficient validation of user-supplied input. An attacker with 'netadmin' privileges can exploit this by uploading a crafted file to the system, leading to command injection. Successful exploitation allows the attacker to elevate privileges to the root user. Cisco has confirmed active exploitation in the wild, noting instances where attackers successfully pushed configuration changes to downstream edge devices. A fix was released on May 14, 2026.

Affected products

  • Cisco Catalyst SD-WAN Manager All versions prior to May 14, 2026 fix

Timeline

  • 2026-05-14: patched: Fixed software documented in Cisco advisory
  • 2026-06-04: advisory: Initial NVD publication date
  • 2026-06-09: disclosed
  • 2026-06-09: exploited: Reported as exploited in the wild in advisory text

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.