Mandiant Reports Cisco SD-WAN Zero-Day Compromise of Communications Provider

Summary

Mandiant says an attacker exploited Cisco SD-WAN vulnerabilities to compromise an unnamed communications provider, create a root-level account and potentially gain broad network visibility. Cisco patched the zero-day and urged customers to upgrade.

Key points

Mandiant reported that an attacker compromised an unnamed communications service provider and gained root-level access to its network.
The activity targeted Cisco Catalyst SD-WAN Manager and related edge devices in two waves, from late 2025 through March 2026.
Mandiant said the first wave involved CVE-2026-20127 or CVE-2026-20182 and unauthorized peering connections to SD-WAN Manager devices.
The attacker then exploited zero-day CVE-2026-20245, manipulated default account passwords and created a rogue root-level account named “troot.”
Mandiant said stealth and evidence deletion prevented it from fully assessing the compromise; the potential for broad network-traffic visibility was not confirmed as an observed impact.
Mandiant did not attribute the activity to a specific threat group. Cisco said it had patched the flaw and recommended upgrading to a fixed release.

Article Details

Victim Organization: Not disclosed
Victim Domain: Not disclosed
Incident Type: Cisco Catalyst SD-WAN Manager compromise through exploitation of vulnerabilities, including a zero-day, followed by unauthorized access and privilege escalation.
Affected Records: Not disclosed
Affected Data Size: Not disclosed
Operational Impact: The attacker gained root-level access and could have obtained broad, undetected visibility into internal network traffic. Mandiant said it could not fully assess the extent of the compromise because the activity was concealed.
Ransom Or Extortion: None reported
Claim Status: confirmed