Cisco has alerted customers to a serious unpatched zero-day vulnerability in its Catalyst SD-WAN Manager product. Identified as CVE-2026-20245, the issue is already under active exploitation and allows attackers to escalate privileges to the root level.

The flaw affects every type of deployment, from on-premises setups to cloud-managed versions and government-specific instances. It arises from inadequate checks on user-provided input, enabling low-privileged local attackers to run arbitrary commands with full root rights.

According to the advisory, an attacker can upload a specially crafted file to trigger command injection and elevate access. Successful exploitation requires netadmin rights, which may be obtained through valid credentials or by chaining with other recently disclosed vulnerabilities such as CVE-2026-20182 and CVE-2026-20127. Cisco noted limited observed cases where exploitation led to configuration changes pushed to edge devices.

The SD-WAN Manager, previously called vManage, lets administrators oversee as many as 6,000 devices through one interface. The company's security team learned of the flaw in June after Mandiant disclosed it privately.

Administrators are urged to inspect the /var/log/scripts.log file for suspicious entries involving tenant configuration uploads to vSmart controllers. An example log line shows a malicious CSV file being processed through a legitimate script. Customers suspecting compromise should open a case with Cisco TAC and generate an admin-tech file for analysis.

Related issues and patch status

Cisco has not yet issued a fix for this vulnerability. It recommends applying the software update released on May 14 that addresses the earlier authentication bypass flaw CVE-2026-20182. In recent months the vendor has also resolved multiple other actively exploited SD-WAN Manager issues, including information disclosure and authentication bypass problems tracked under several additional CVEs.

CISA has now listed 90 Cisco vulnerabilities as exploited in the wild, with four affecting the Catalyst SD-WAN Manager and several others linked to ransomware campaigns.