Cisco SD-WAN Zero-Day CVE-2026-20245: Root-Level Command Injection Exploited Two Months Before Disclosure

Mandiant has revealed that attackers exploited a critical zero-day vulnerability in Cisco Catalyst SD-WAN Manager—tracked as CVE-2026-20245—as early as March 2026, roughly two months before Cisco publicly disclosed it.

This high-severity command injection flaw (CVSS 7.8) allows authenticated attackers with netadmin privileges to execute arbitrary commands as root by uploading a crafted file.

In a stark reminder that network infrastructure remains a prime target for sophisticated adversaries...