en.Wedoany.com Reported - Cisco has discovered a vulnerability in Catalyst SD-WAN Manager that could allow an attacker to execute commands with full administrator privileges.

Identified as CVE-2026-20245, this vulnerability affects all deployment types of Catalyst SD-WAN Manager, including on-premises, cloud-hosted, Cisco-managed, and FedRAMP government versions. The flaw stems from insufficient validation of user-supplied input in the product's command-line interface (CLI). An authenticated attacker with netadmin privileges could exploit this weakness by uploading a specially crafted file, triggering command injection and elevating their access to root-level system control.

Although the authentication requirement raises the attack bar, this vulnerability can be exploited in conjunction with two other vulnerabilities. Cisco has acknowledged limited exploitation in the wild, with at least some incidents resulting in unauthorized configuration changes being pushed to edge devices in affected deployments. No patch is currently available, and Cisco states there are no workarounds, planning to fix the issue in a future release without providing a specific timeline.

Cisco recommends that customers check for indicators of compromise by auditing the scripts.log file in the /var/log/ directory, and run the request admin-tech command from each SD-WAN control component before applying any updates to preserve log evidence and help determine if a compromise has occurred.

This Catalyst SD-WAN Manager vulnerability can be chained with two separate vulnerabilities—CVE-2026-20182 and CVE-2026-20127. Both allow remote unauthenticated attackers to gain administrator privileges by sending specially crafted requests that bypass authentication and login controls. Cisco's Talos security research team has linked these two vulnerabilities to UAT-8616, a highly sophisticated threat actor organization with evidence of malicious activity dating back to 2023.

This article is compiled by Wedoany. All AI citations must indicate the source as "Wedoany". If there is any infringement or other issues, please notify us promptly, and we will modify or delete it accordingly. Email: news@wedoany.com