Mandiant Details Cisco SD-WAN Zero-Day Attacks That Created Rogue Root Accounts
Summary
Mandiant says attackers used CVE-2026-20245 to escalate privileges on Cisco Catalyst SD-WAN devices after gaining access. They created a rogue root account and erased traces; Mandiant published indicators and response guidance.
Key points
- Mandiant says the intrusions began with unauthorized SD-WAN peering on a service provider's infrastructure.
- Attackers authenticated to affected SD-WAN Manager devices using the vmanage-admin account; how the rogue peering was established remains unclear.
- The attackers exploited CVE-2026-20245, a high-severity command injection flaw, by uploading a malicious CSV file through a tenant-upload feature.
- The payload created a root-level account named “troot”; attackers also extracted SD-WAN configuration information.
- Mandiant observed attackers restoring account changes, deleting the CSV and temporary files, and removing evidence of the rogue account.
- Cisco released fixed software versions and said no workaround was available. Mandiant published indicators and recommended checking for unauthorized peering and upgrading.
Article Details
- Attack Vectors
- The intrusion began with unauthorized SD-WAN peering connections on a service provider network.
- The attackers authenticated to affected SD-WAN Manager devices using the vmanage-admin account; Mandiant said the method used to establish some rogue peering connections was unclear.
- The attackers uploaded a malicious CSV file named evil_tenant.csv through the SD-WAN CLI tenant-upload feature to exploit CVE-2026-20245 and execute commands as root.
- The attackers changed the default admin account password, extracted SD-WAN configuration information, and later restored the original password.
- The attackers used the Linux su command to switch to the newly created root-level troot account.
- Defensive Notes
- Cisco released security updates and urged customers to upgrade to fixed software versions; Cisco stated that no workarounds were available.
- Collect diagnostic data from SD-WAN devices and check for unauthorized peering connections.
- Mandiant recommended checking devices for evidence of compromise and upgrading to the latest software releases.
MITRE ATT&CK
T1059.004 · Unix ShellAfter creating troot, the attackers used the Linux su command to switch from the compromised administrative account to the root-level account.T1068 · Exploitation for Privilege EscalationThe attackers exploited CVE-2026-20245 after gaining access to escalate privileges and create the root-level troot account.T1070.004 · File DeletionThe attackers deleted the malicious CSV payload and temporary files and erased evidence of the rogue root account.T1078 · Valid AccountsThe attackers authenticated to affected SD-WAN Manager devices using the vmanage-admin account; the article does not establish how they obtained or accessed it.T1098 · Account ManipulationThe attackers changed the default admin account password and later restored its original password.T1105 · Ingress Tool TransferThe attackers uploaded the malicious evil_tenant.csv file to the SD-WAN device through the CLI tenant-upload feature.T1136.001 · Local AccountThe malicious CSV payload created a local root-level account named troot on targeted SD-WAN devices.
CVE
CVE-2026-20127Cisco · Cisco Catalyst SD-WAN ManagerMandiant believes the rogue peering may have been created by exploiting previously disclosed Cisco SD-WAN authentication bypass zero-days, CVE-2026-20127 and CVE-2026-20182, though the exact method remains unclear.CVE-2026-20182Cisco · Cisco Catalyst SD-WAN Controller; Cisco · Cisco Catalyst SD-WAN ManagerMandiant believes the rogue peering may have been created by exploiting previously disclosed Cisco SD-WAN authentication bypass zero-days, CVE-2026-20127 and CVE-2026-20182, though the exact method remains unclear.CVE-2026-20245Cisco · Cisco Catalyst SD-WAN Controller; Cisco · Cisco Catalyst SD-WAN ManagerMandiant revealed that CVE-2026-20245 in Cisco Catalyst SD-WAN was used in zero-day attacks to escalate privileges and create a rogue root account named “troot” on targeted devices.
Vendors
Products
Cisco Catalyst SD-WANMandiant revealed that CVE-2026-20245 in Cisco Catalyst SD-WAN was used in zero-day attacks to escalate privileges and create a rogue root account named “troot” on targeted devices.Cisco Catalyst SD-WAN ManagerThe CVE-2026-20245 vulnerability is a high-severity command injection flaw in Cisco Catalyst SD-WAN Manager (vManage), Controller (vSmart), and Validator (vBond) that allows authenticated attackers to execute arbitrary