Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access

Mandiant revealed how attackers exploited CVE-2026-20245, a high-severity command injection flaw in Cisco Catalyst SD-WAN Manager, Controller, and Validator, to create rogue root accounts. The intrusion began with unauthorized SD-WAN peering connections on a service provider's infrastructure starting in March 2026.