VulnRadar

Data against noise.

Built with NaN
Page generated: 11 Nov 2026, 01:11 UTC
← Dashboard

CVE-2026-20245

A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands a…

Read full description
A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user. To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices. Cisco recommends that customers upgrade to the fixed software that is documented in the that was published on May 14, 2026, and verify the configuration of the edge devices.
CVSS 7.8 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
8.3/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 7.8: +1.17
  • Fresh EPSS: 25.32%: +0.13

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 27 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

The Hacker News
Press · 30 Sep 2026, 07:00 · Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager - The Hacker News
The Hacker News
Press · 25 Jun 2026, 07:00 · Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access - The Hacker News
Rescana
Press · 25 Jun 2026, 07:00 · Active Exploitation Alert: Cisco Catalyst SD-WAN Zero-Day (CVE-2026-20245) Enables Root Access via Authenticated File Upload Exploit - Rescana
Rescana
Press · 25 Jun 2026, 07:00 · Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Actively Exploited for Root Access and Management Plane Compromise - Rescana
SecurityWeek
Press · 25 Jun 2026, 07:00 · Cisco SD-WAN Zero-Day Exploited Months Before Patching - SecurityWeek
See all 27 source documents
Threat Intelligence
Press · 24 Jun 2026, 11:00 · Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager
Threat Intelligence
Press · 24 Jun 2026, 11:00 · Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager
Infosecurity Magazine
Press · 24 Jun 2026, 07:00 · Cisco Vulnerability Exploited Months Before Disclosure, Google Warns - Infosecurity Magazine
BleepingComputer
Press · 24 Jun 2026, 07:00 · Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access - BleepingComputer
Dark Reading
Press · 24 Jun 2026, 07:00 · Attackers Hit Cisco SD-WAN Flaw 2 Months Before Disclosure - Dark Reading
Google Cloud
Press · 24 Jun 2026, 07:00 · Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager - Google Cloud
The Register
Press · 24 Jun 2026, 07:00 · The hits keep on coming for Cisco vulnerabilities - The Register
Help Net Security
Press · 16 Jun 2026, 07:00 · Cisco discloses second exploited SD-WAN vulnerability in two weeks (CVE-2026-20262) - Help Net Security
SecurityWeek
Press · 16 Jun 2026, 07:00 · Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks - SecurityWeek
The Hacker News
Press · 16 Jun 2026, 07:00 · Cisco Releases Security Updates for Actively Exploited SD-WAN Manager Flaw - The Hacker News
Cybersecurity Dive
Press · 10 Jun 2026, 07:00 · CISA, researchers warn of escalating attacks using Cisco Catalyst SD-WAN flaws - Cybersecurity Dive
The Hacker News
Press · 10 Jun 2026, 07:00 · CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation - The Hacker News
CyberScoop
Press · 09 Jun 2026, 07:00 · Cisco customers encounter another SD-WAN zero-day under attack - CyberScoop
Rescana
Press · 07 Jun 2026, 07:00 · Active Exploitation Alert: Cisco Catalyst SD-WAN Manager CVE-2026-20245 Zero-Day Under Attack With No Patch Available - Rescana
The Hacker News
Press · 06 Jun 2026, 07:00 · Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited - The Hacker News
SecurityWeek
Press · 05 Jun 2026, 07:00 · Cisco Warns of 7th SD-WAN Zero-Day Exploited in 2026 - SecurityWeek
BleepingComputer
Press · 05 Jun 2026, 07:00 · Cisco warns of unpatched SD-WAN zero-day exploited in attacks - BleepingComputer
Security Affairs
Press · 05 Jun 2026, 07:00 · Cisco SD-WAN Has a New Root-Level Problem, and There’s No Fix Yet - Security Affairs
CyberSecurityNews
Press · 05 Jun 2026, 07:00 · Cisco SD-WAN Vulnerability Exploited in the Wild to Execute Arbitrary Commands as Root User - CyberSecurityNews
Help Net Security
Press · 05 Jun 2026, 07:00 · Cisco SD-WAN 0-day exploited, no patch available (CVE-2026-20245) - Help Net Security
SOC Prime
Press · 05 Jun 2026, 07:00 · CVE-2026-20245: Cisco SD-WAN Manager Zero-Day Enables Root Command Execution - SOC Prime
Cybersecurity Dive
Press · 05 Jun 2026, 07:00 · Cisco warns zero-day flaw in SD-WAN is being exploited - Cybersecurity Dive

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.3 (2026-11-02 15:14). The curve appears once the score changes.

Public exploit evidence

1

Public exploit entries / repo candidates

See 1 repos with metrics
RepositoryStarsForksLanguageUpdated
fevar54/CVE-2026-20245---Cisco-SD-WAN-Privilege-Escalation-Exploit03Python10 Jun 2026, 15:46
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 7.8; EPSS 25.3%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
local access, low privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-06 14:20:28.918678+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Primary reports used by this score

  • Google Threat Intelligence

    Automatic extraction found a source statement about exploitation in attacks naming CVE-2026-20245.

    Mandiant observed that in April 2026, after establishing an SSH session with the account, the threat actor exploited CVE-2026-20245 by executing the following command to

    Scope: Only the cited paragraph and its stated conditions; not a prevalence estimate.

    Attack observation: not dated; automatic extraction: primary-assertions-v1; not independently reviewed.

  • Google Threat Intelligence

    Automatic extraction found a source statement about exploitation in attacks naming CVE-2026-20245.

    Mandiant observed that in April 2026, after establishing an SSH session with the account, the threat actor exploited CVE-2026-20245 by executing the following command to

    Scope: Only the cited paragraph and its stated conditions; not a prevalence estimate.

    Attack observation: not dated; automatic extraction: primary-assertions-v1; not independently reviewed.

Source event timeline
Published
04 Jun 2026, 22:33
First press mention
05 Jun 2026, 07:00
Added to the CISA KEV catalog
09 Jun 2026, 00:00
Latest press mention
30 Sep 2026, 07:00
Score calculated
06 Nov 2026, 14:20
PoCs on GitHub
1 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar