Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager

Mandiant identified a threat actor exploiting CVE-2026-20245, a zero-day privilege escalation vulnerability in Cisco Catalyst SD-WAN Manager. The attacker gained root access via a malicious CSV upload after establishing unauthorized peering connections. Anti-forensic techniques were used to delete files and revert changes to avoid detection.