CVE-2026-20245: Cisco Catalyst SD-WAN Critical Command Injection Vulnerability

Technical summary

The vulnerability stems from insufficient input validation in the CLI of the Catalyst SD-WAN control plane components. When a netadmin-authenticated user supplies a crafted file to the system, it is processed without proper sanitization, enabling command injection. The attacker can execute arbitrary shell commands with root privileges, bypassing normal access controls. The CVSS 3.1 score of 7.8 (HIGH) reflects local attack vector, low complexity, low privilege requirements (netadmin role), and high impact across confidentiality, integrity, and availability. CWE-116 (Improper Encoding or Escaping of Output) indicates the root cause is inadequate output/command boundary enforcement.

Business impact

Compromise of the SD-WAN control plane can have cascading effects: attackers gain the ability to reconfigure or degrade the WAN, push malicious settings to all connected branch devices, intercept or manipulate traffic, and potentially establish persistence across the network. Given that SD-WAN controllers manage traffic policies and device configurations for distributed enterprises, this vulnerability threatens the integrity of branch connectivity, compliance with traffic steering policies, and the confidentiality of data traversing the WAN. Cisco has observed limited cases of configuration tampering already occurring in the wild.

Affected systems

Cisco Catalyst SD-WAN Manager (formerly vManage), Catalyst SD-WAN Controller (formerly vSmart), and Catalyst SD-WAN Validator (formerly vBond) are affected. The vulnerability applies to the CLI interface of these control plane appliances. Any organization running these SD-WAN management platforms is in scope if their systems are accessible to users with netadmin credentials—whether legitimate users or attackers who have compromised valid accounts.

Exploitability

Exploitation requires valid netadmin-level credentials or prior compromise of an account with that privilege level. The attack is straightforward (low complexity) once authenticated: upload a crafted file and trigger command execution. Cisco has not observed widespread exploitation via alternative methods, and the KEV entry was added on June 9, 2026 with an exploitation due date of June 23, 2026, indicating active, targeted use in the wild. The ransomware association is currently unknown, but the root-access capability and control-plane positioning make this a high-value target for persistent threats.

Remediation

Cisco published a security advisory on May 14, 2026 documenting fixed software versions. Organizations must upgrade their Catalyst SD-WAN Manager, Controller, and Validator instances to patched releases. After patching, verify the configuration of all edge devices to ensure no unauthorized changes were introduced during the window of vulnerability. This includes auditing policy rules, device certificates, and traffic steering configurations. Enforce strong credential hygiene and consider restricting netadmin account usage to least-privilege operations.

Patch guidance

Consult Cisco's official security advisory (published May 14, 2026) for specific fixed version numbers for each component. Patching the control plane should be prioritized as it is a central management hub; test patches in a staging environment first if feasible, though the security risk may warrant rapid production deployment. After upgrade, run configuration audits and validate that edge devices receive only legitimate policy updates. Document any suspicious configuration changes observed since the vulnerability was introduced.

Detection guidance

Monitor CLI access logs and file upload events on Catalyst SD-WAN control plane appliances. Look for unusual file uploads by netadmin users, especially files with shell metacharacters or unexpected extensions. Alert on any command execution events following file uploads, particularly those with root-level commands. Network-based detection should focus on lateral movement from the control plane to edge devices immediately after a successful exploit. Endpoint detection and response (EDR) agents on control plane appliances can flag anomalous child process spawning or privilege escalation patterns.

Why prioritize this

This vulnerability merits immediate attention due to its KEV status, active exploitation reports, and the high-value target (SD-WAN control plane). The ability to escalate to root and push configurations across the WAN fabric elevates risk significantly. Even though authentication is required, the prevalence of credential compromise and the already-observed malicious configuration changes in the wild justify emergency patching before the June 23, 2026 due date.

Risk score, explained

CVSS 7.8 (HIGH) reflects: (1) Local attack vector—attacker needs console or valid remote shell access; (2) Low attack complexity—no special conditions required once authenticated; (3) Low privilege requirement—netadmin role is common in SD-WAN deployments; (4) High impact on CIA—root command execution permits full system compromise and persistent backdoor placement. The real-world severity is amplified by KEV status and observed active exploitation, pushing operational risk into the CRITICAL range for organizations that depend on SD-WAN integrity.

Frequently asked questions