CVE-2026-20245

What it actually does

The flaw is a command injection vulnerability in the CLI handling of Cisco Catalyst SD-WAN Controller/vSmart, SD-WAN Manager/vManage, and SD-WAN Validator/vBond. A user with netadmin-level access can upload or supply a crafted file that is not sufficiently validated before being processed by the system. Because the affected processing path can execute attacker-controlled input in a privileged context, successful exploitation allows arbitrary operating system command execution as root. The practical result is full compromise of the affected SD-WAN control-plane appliance, including access to sensitive configuration, ability to alter system state, persistence opportunities, and potential downstream configuration changes to managed edge devices.

Why it matters to the business

This vulnerability can turn a compromised or malicious netadmin account into full administrative control of SD-WAN control-plane infrastructure. For organizations using Cisco Catalyst SD-WAN, that can affect routing policy, branch connectivity, segmentation, VPN behavior, and centralized configuration pushed to edge devices. Cisco has observed limited exploitation that resulted in configuration changes being pushed to edge devices, so the risk is not only appliance compromise but also operational disruption or unauthorized network-wide changes. The vulnerability is listed in CISA KEV, has active in-the-wild exploitation, and the KEV remediation deadline of 2026-06-23 has passed, making remediation urgent for exposed or unpatched deployments.

How an attack unfolds

An attacker first obtains valid credentials with netadmin privileges on an affected Cisco Catalyst SD-WAN component, or reaches that privilege level through another weakness or credential compromise. The attacker then uses the local CLI workflow to upload or provide a specially crafted file to the appliance. When the affected software processes the file, insufficient input validation allows attacker-controlled content to be interpreted as operating system commands. Those commands execute with root privileges, giving the attacker full control of the appliance. From there, the attacker may inspect or alter SD-WAN configuration, create persistence, access sensitive operational data, modify local system files, and potentially push malicious or unauthorized configuration changes to downstream edge devices managed by the SD-WAN fabric.

How to fix it

Upgrade affected Cisco Catalyst SD-WAN Manager/vManage, Controller/vSmart, and Validator/vBond systems to a Cisco fixed software release identified in Cisco’s security advisory published on May 14, 2026. No exact fixed version was provided in the input, so operators should verify the correct fixed release for each deployed train directly against Cisco’s advisory and software checker. Because Cisco observed exploitation causing configuration changes pushed to edge devices, remediation should include both software upgrade and configuration review of managed edge devices. Until upgrades are complete, restrict CLI and management access to trusted administrative networks, enforce MFA and strong authentication for administrative accounts, review and reduce netadmin assignments, rotate credentials for privileged users, and monitor for unexpected file uploads, root command execution, and configuration pushes. If exploitation is suspected, treat the appliance as fully compromised and follow incident response procedures rather than relying on mitigation alone.

How to confirm the fix worked

Confirm the running software versions on all Cisco Catalyst SD-WAN Manager, Controller, and Validator appliances and compare them against Cisco’s fixed-release guidance for this vulnerability. Verify that all appliances in the SD-WAN control plane have been upgraded, not only the Manager/vManage node. Validate that only expected users retain netadmin privileges and that CLI access is limited to approved administrative paths. Review SD-WAN configuration audit history and edge-device configuration state before and after the upgrade to identify unauthorized changes. Where possible, perform a non-destructive administrative test that confirms crafted file content is rejected or safely handled by the patched CLI workflow. Also verify that no unexpected local users, SSH keys, scheduled jobs, startup scripts, or modified system files remain after remediation.

Typical attack path

1. Obtain valid credentials or an existing session with netadmin privileges on an affected Cisco Catalyst SD-WAN appliance.
2. Access the affected CLI on the SD-WAN Manager, Controller, or Validator system.
3. Upload or supply a crafted file designed to trigger command injection during CLI-side processing.
4. Cause the vulnerable process to execute embedded attacker-controlled commands as root.
5. Use root access to inspect configuration, modify system state, add persistence, or collect sensitive data.
6. Optionally push unauthorized configuration changes to SD-WAN edge devices through the compromised control-plane component.
7. Delete or alter logs and temporary files to reduce forensic visibility.

How to detect it

Review management-plane authentication, CLI, file-transfer, system, and SD-WAN configuration audit logs for activity by netadmin users that does not align with approved maintenance. Focus on the period before patching and especially since public disclosure, because exploitation has been observed in the wild. Look for successful or failed logins from unusual source addresses, new or unexpected netadmin sessions, file uploads followed closely by root-level process execution, shell metacharacters in uploaded filenames or file content, unexpected changes to local users or SSH keys, and configuration pushes to edge devices without matching change tickets. On the appliance, inspect system logs for abnormal root command execution, sudo or shell invocation by SD-WAN services, unexpected child processes spawned by management or CLI components, modifications to startup scripts or cron jobs, and cleanup behavior such as log truncation. In the SD-WAN management interface, review configuration audit history, template changes, policy changes, device pushes, and admin-user changes. If Cisco support bundles or forensic images are collected, preserve them before upgrade or rebuild so investigators can compare timestamps, uploaded files, process history, and configuration diffs.

• /var/log/nms/vmanage-server.log
• /var/log/nms/management-server.log
• /var/log/audit/audit.log
• /var/log/auth.log
• /var/log/messages
• /var/log/secure
• /var/log/viptela/
• /etc/passwd
• /etc/shadow
• /etc/sudoers
• /etc/ssh/authorized_keys
• /root/.ssh/authorized_keys
• /var/spool/cron/
• /etc/crontab
• /etc/cron.d/
• /etc/rc.local
• /etc/systemd/system/
• $((
• $(
• `
• ;
• |
• &&
• unexpected configuration push
• device configuration push
• netadmin

What your security team should do

• Treat this as a high-priority vulnerability because it is in CISA KEV, has active exploitation reported, and the KEV remediation deadline has already passed.
• Inventory all Cisco Catalyst SD-WAN Manager/vManage, Controller/vSmart, and Validator/vBond appliances and identify their running software versions.
• Upgrade every affected appliance to the fixed Cisco software release for its train, following Cisco’s May 14, 2026 advisory.
• Immediately review all accounts with netadmin privileges and remove unnecessary access.
• Restrict management-plane and CLI access to hardened administrative networks and enforce MFA where supported.
• Review SD-WAN audit logs for crafted file uploads, unexpected CLI activity, root-level command execution, and configuration changes pushed to edge devices.
• Compare current edge-device configurations against known-good baselines to detect unauthorized changes.
• Rotate credentials and API tokens associated with privileged SD-WAN administration if exploitation is suspected.
• If compromise indicators are found, perform full incident response on the appliance and managed fabric rather than only applying the patch.