{"uuid": "a332cbf0-56f6-4f88-8ee6-d401bde71782", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20245", "type": "seen", "source": "https://infosec.exchange/users/edwardk/statuses/116810667285243144", "content": "Zero-Day Exploitation of Vulnerability CVE-2026-20245 in Cisco Catalyst SD-WAN Manager\u2028Source URL: https://cloud.google.com/blog/topics/threat-intelligence/zero-day-exploitation-cisco-catalyst-sd-wan-manager/\u2028Mandiant reported that a threat actor targeting SD-WAN infrastructure at a service provider used a compromised administrative account and then exploited CVE-2026-20245, a zero-day vulnerability in Cisco Catalyst SD-WAN Manager, to escalate privileges to root. The vulnerability stems from insufficient filtering of malicious data in the device\u2019s file-upload functionality, and the actor reportedly used anti-forensic techniques such as selectively deleting and restoring modified configuration files to reduce detection. The issue is particularly relevant for organizations that rely on SD-WAN control planes because compromise of management infrastructure can have broad downstream impact across connectivity, routing, segmentation and service-provider trust boundaries.", "creation_timestamp": "2026-06-25T12:08:52.749519Z"}