Mandiant Details Zero-Day Exploitation of Cisco Catalyst SD-WAN Manager
Summary
Mandiant reports that an attacker used rogue peering and stolen credentials to access a service provider’s Cisco SD-WAN infrastructure, then exploited CVE-2026-20245 for root access and erased evidence. Cisco fixed the vulnerability in later releases.
Key points
- The intrusion targeted a service provider’s Cisco Catalyst SD-WAN Manager devices; Mandiant says it is unclear whether the observed activity across different periods involved the same actor.
- The attacker used unauthorized peering connections for SSH access, manipulated the default admin password, and exfiltrated SD-WAN fabric configurations.
- A malicious CSV upload exploited CVE-2026-20245, an authenticated local privilege-escalation flaw, to execute commands as root and create a privileged account.
- The attacker deleted created files, restored modified configurations, and ran a script to check whether evidence of the intrusion remained.
- Mandiant says earlier rogue peering may have involved CVE-2026-20127 or CVE-2026-20182, but the cause was not confirmed; later activity may have used previously stolen certificate material.
- Cisco fixed CVE-2026-20245 in specified later software releases; Mandiant recommends upgrading, reviewing device logs and IOCs, and escalating confirmed suspicious activity to Cisco TAC.
- Mandiant provides indicators and detection guidance for unexpected SSH logins, admin password changes, suspicious use of su, and tenant-list upload commands.
Article Details
- Attack Vectors
- Unauthorized SD-WAN peering connections were used to facilitate SSH access; the article says the cause of earlier connections may have been CVE-2026-20127 or CVE-2026-20182, while later activity may have used stolen certificate material.
- After authenticating with the vmanage-admin account, the threat actor changed the default admin password, accessed the SD-WAN Manager web interface, and exfiltrated SD-WAN fabric configurations.
- The actor exploited CVE-2026-20245 by uploading a crafted CSV file, enabling arbitrary command execution as root and creation of a root-privileged troot account.
- Defensive Notes
- Upgrade Cisco Catalyst SD-WAN Manager to a fixed release listed in the article: 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, 26.1.1.2, or later.
- Collect SD-WAN device logs and diagnostic data, hunt for the reported indicators and behaviors, and investigate confirmed hits.
- Monitor for unexpected SSH logins as vmanage-admin, rapid admin password changes and reversions, suspicious su activity, and unauthorized execution of vconfd_script_upload_tenant_list.sh.
- Inspect rollback files in /var/confd/rollback/ for unexpected password-related configuration changes, and forward suspicious activity or confirmed indicators to Cisco TAC.
- Follow the Cisco Catalyst SD-WAN Hardening Guide and logging guidance.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 126[.]51[.]108[.]152 | IP address reported as connecting as a rogue device and exploiting CVE-2026-20245. |
| IPV4 | 153[.]186[.]231[.]233 | IP address listed among those connecting as rogue devices. |
| IPV4 | 167[.]179[.]79[.]189 | IP address listed among those connecting as rogue devices. |
| IPV4 | 207[.]190[.]37[.]94 | IP address listed among those connecting as rogue devices. |
| IPV4 | 209[.]137[.]225[.]101 | IP address listed among those connecting as rogue devices. |
| IPV4 | 23[.]245[.]7[.]178 | IP address listed among those connecting as rogue devices. |
| IPV4 | 45[.]32[.]38[.]160 | IP address listed among those connecting as rogue devices. |
| IPV4 | 76[.]92[.]245[.]217 | IP address reported as connecting as a rogue device. |
| SHA256 | b82936f37648518425c7d3cf9e09eaffa41d7cdb3840f6a40287e3a108880f7b | Hash of a recovered remnant of the malicious CSV exploit payload. |
MITRE ATT&CK
T1021.004 · SSHThe actor used SSH to access the SD-WAN Manager after establishing rogue peer connections.T1070.004 · File DeletionThe actor deleted the malicious CSV and other created files during anti-forensic cleanup.T1070.009 · Clear PersistenceThe actor restored modified system configuration files and account-file state to reduce forensic evidence.T1078 · Valid AccountsThe actor authenticated using the vmanage-admin and admin accounts.T1098.001 · Additional Cloud CredentialsThe actor changed the default admin account password and later restored it.T1098.004 · SSH Authorized KeysThe exploit created the root-privileged troot account, which the actor subsequently accessed with su.T1133 · External Remote ServicesThe actor used unauthorized peering connections to establish remote access to the SD-WAN devices.T1190 · Exploit Public-Facing ApplicationThe actor exploited CVE-2026-20245 through a crafted CSV upload to obtain root-level command execution.T1213 · Data from Information RepositoriesThe actor accessed and exfiltrated configurations of the SD-WAN fabric.
CVE
CVE-2026-20127CVE-2026-20127 and CVE-2026-20182 are critical vulnerabilities recently disclosed by Cisco that affect the peering authentication mechanism for Cisco Catalyst SD-WAN controllers.CVE-2026-20182CVE-2026-20127 and CVE-2026-20182 are critical vulnerabilities recently disclosed by Cisco that affect the peering authentication mechanism for Cisco Catalyst SD-WAN controllers.CVE-2026-20245After gaining initial access, the threat actor exploited a zero-day vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN to escalate privileges from a compromised administrative account to root-level access.
People
Vendors
CiscoAfter gaining initial access, the threat actor exploited a zero-day vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN to escalate privileges from a compromised administrative account to root-level access.GoogleGoogle Threat Intelligence Group (GTIG) has closely tracked and reported on increased zero-day exploitation of edge devices over the past several years.
Products
Cisco Catalyst SD-WANAfter gaining initial access, the threat actor exploited a zero-day vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN to escalate privileges from a compromised administrative account to root-level access.Cisco Catalyst SD-WAN Managerleveraged a zero-day privilege escalation vulnerability (now tracked as CVE-2026-20245) in Cisco Catalyst SD-WAN Manager to gain root-level access via a malicious CSV upload.Google SecOpsGoogle SecOps customers have access to these broad category rules and more under the Mandiant Intel Emerging Threats rule pack.