CVE-2026-20245 is a command-injection flaw in the CLI of Cisco Catalyst SD-WAN Controller, Manager and Validator that lets an authenticated attacker with netadmin privileges upload a crafted file and execute arbitrary commands as root, and Cisco confirms limited real-world exploitation that pushed unauthorized configuration changes to edge devices.
Vulnerability summary
7.8
High
25.3%
EPSS score (FIRST)
Yes
CISA KEV catalog
2026-06-04
Published
Vulnerability ID: CVE-2026-20245 · Source: Cisco PSIRT (not NVD-confirmed)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Cisco Catalyst SD-WAN Manager (vManage) | cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:* | 20.9.9.1 and earlier (fixed 20.9.9.2); 20.12.7.1 and earlier (fixed 20.12.7.2); 20.15.4.4 and earlier (fixed 20.15.4.5); 20.15.5.2 and earlier (fixed 20.15.5.3); 20.18.2.2 and earlier (fixed 20.18.3.1); 26.1.1.1 and earlier (fixed 26.1.1.2) |
| Cisco Catalyst SD-WAN Controller (vSmart) / Validator (vBond) | cpe:2.3:a:cisco:catalyst_sd-wan_controller:*:*:*:*:*:*:*:* | Same release trains as Catalyst SD-WAN Manager above, across On-Prem, Cloud-Pro, Cisco-managed Cloud and FedRAMP deployments |
What this means
CVE-2026-20245 is a CWE-116 (Improper Encoding or Escaping of Output) vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, Catalyst SD-WAN Controller and Catalyst SD-WAN Validator. NVD's record states the flaw lets "an authenticated, local attacker execute arbitrary commands as root by supplying a crafted file to the affected system" due to insufficient validation of user-supplied input (NVD).
NVD lists only a Secondary CVSS v3.1 score from source [email protected]: base score 7.8 (high), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. NVD's vulnerability status is "Analyzed," but no NVD Primary metric is published, so this score is labelled not NVD-confirmed on this page (NVD).
Cisco's advisory cisco-sa-sdwan-privesc-4uxFrdzx ("Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator Authenticated Privilege Escalation Vulnerability") confirms the same 7.8 score and vector, lists the fixed releases above, and states plainly: "There are no workarounds that address this vulnerability." Cisco notes exploitation requires the attacker to already hold netadmin credentials, obtainable directly or by chaining CVE-2026-20182 or CVE-2026-20127, and states: "In June 2026, the Cisco PSIRT became aware of exploitation of this vulnerability," with limited observed cases resulting in unauthorized configuration changes pushed to edge devices (Cisco Security Advisory cisco-sa-sdwan-privesc-4uxFrdzx).
CISA added CVE-2026-20245 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-06-09, with a required-action due date of 2026-06-23, confirmed present in the live KEV catalog's CVE-filtered view this run (CISA KEV).
As of 2026-10-30, FIRST scores the probability of exploitation at 0.25323 (97.94th percentile) — high relative to most CVEs, consistent with this being the seventh Cisco Catalyst SD-WAN zero-day exploited in 2026 and a frequently chained post-authentication escalation step (FIRST EPSS).
Because there is no workaround, any Cisco Catalyst SD-WAN Manager, Controller or Validator deployment on an affected release should be upgraded to the fixed version immediately, and operators should also close the credential-exposure paths (CVE-2026-20182, CVE-2026-20127) that let a remote attacker reach the netadmin privileges this bug needs.
Evidence
- CLI command-injection vulnerability in Cisco Catalyst SD-WAN Manager/Controller/Validator lets an authenticated, local netadmin attacker execute arbitrary commands as root via a crafted uploaded file. — NVD
- NVD lists only a Secondary CVSS v3.1 score of 7.8 (high) from source [email protected], vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; no NVD Primary metric is published. — NVD
- No workaround exists; fixed releases are 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1 and 26.1.1.2. Cisco PSIRT became aware of exploitation in June 2026, with limited cases pushing unauthorized configuration changes to edge devices; exploitation requires netadmin credentials obtainable via CVE-2026-20182 or CVE-2026-20127. — Cisco Security Advisory cisco-sa-sdwan-privesc-4uxFrdzx
- Added to the CISA KEV catalog on 2026-06-09, required-action due date 2026-06-23. — CISA KEV
- EPSS score is 0.25323 (97.94th percentile) as of 2026-10-30. — FIRST EPSS
