Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2026-20245

A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user. To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices. Cisco recommends that customers upgrade to the fixed software that is documented in the that was published on May 14, 2026, and verify the configuration of the edge devices.

CVSS 7.8 · HighBuzz score 75.0KEV listed

Buzz score

Why this CVE is surfacing

Buzz score total 75.0

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 30.0 · diversity 20.0 · KEV 25.0 · OTX 0.0 · PoC 0.0
Mention score
30.0
23 evidence mentions in the snapshot
Diversity score
20.0
10 sources across 4 categories
KEV score
25.0
Known exploited vulnerability present
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
6
within the 30d window
Peak daily
1
highest bucket

Evidence

Source links by recency

Newest mentions first
23 source links · newest first
  • Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator Authenticated Privilege Escalation VulnerabilityCisco Security Advisories

    attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of CVE-2026-20182 or CVE-2026-20127 . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices. Cisco re

    vendorsec.cloudapps.cisco.comJul 21, 2026, 4:01 PM
  • The ‘Ghost’ in the Database: Recovering Active ADFS Signing Keys via Machine DPAPIMandiant

    aratus By Google Threat Intelligence Group • 68-minute read Threat Intelligence Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager By Mandiant • 16-minute read Footer Links Follow us Google Cloud Google Cloud Products Privacy Terms Cookies management controls Help Language ‪English‬ ‪Deutsch‬ ‪Français‬ ‪한국어‬ ‪日本語‬

    vendorcloud.google.comJul 7, 2026, 2:00 PM
  • Google’s Continued Disruption of Malicious Residential Proxy NetworksMandiant

    aratus By Google Threat Intelligence Group • 68-minute read Threat Intelligence Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager By Mandiant • 16-minute read Footer Links Follow us Google Cloud Google Cloud Products Privacy Terms Cookies management controls Help Language ‪English‬ ‪Deutsch‬ ‪Français‬ ‪한국어‬ ‪日本語‬

    vendorcloud.google.comJul 2, 2026, 2:00 PM
  • 22nd June – Threat Intelligence ReportCheck Point Research

    rs showed how game-like prompts could expose credentials and user data. VULNERABILITIES AND PATCHES Cisco has addressed CVE-2026-20245, a high-severity command injection flaw in Catalyst SD-WAN Manager that attackers exploited as a zero-day for months. The flaw allows an administrator to run root commands through a crafted file, affecting on-premises a

    vendorresearch.checkpoint.comJul 1, 2026, 11:29 AM
  • 29th June – Threat Intelligence ReportCheck Point Research

    rs showed how game-like prompts could expose credentials and user data. VULNERABILITIES AND PATCHES Cisco has addressed CVE-2026-20245, a high-severity command injection flaw in Catalyst SD-WAN Manager that attackers exploited as a zero-day for months. The flaw allows an administrator to run root commands through a crafted file, affecting on-premises a

    vendorresearch.checkpoint.comJun 29, 2026, 2:06 PM
  • Security Affairs newsletter Round 583 by Pierluigi Paganini – INTERNATIONAL EDITIONSecurity Affairs

    A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. New FBI Alert: Russian Intelligence Uses Signal Recovery Keys to Access Messages Hospitality Sector Hit by […]

    newssecurityaffairs.comJun 28, 2026, 3:29 PM
  • Cisco Vulnerability Exploited Months Before Disclosure, Google WarnsInfosecurity Magazine

    lnerability in Cisco products at least two months before the flaw was disclosed, a new Google report warned. Tracked as CVE-2026-20245, this high-severity (CVSS 7.8) privilege escalation vulnerability stems from insufficient validation of user-supplied input in the command-line interface (CLI) of Cisco Catalyst SD-WAN Controller, formerly known as SD-W

    newswww.infosecurity-magazine.comJun 25, 2026, 2:15 PM
  • Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited Months Before DisclosureSecurity Affairs

    Hackers exploited Cisco Catalyst SD-WAN flaw CVE-2026-20245 as a zero-day months before disclosure, enabling privileged command execution. Google-owned Mandiant reported that an unknown threat actor exploited Cisco Catalyst SD-WAN vulnerability CVE-2026-20245 (CVSS base score of 7.8) as a zero-day at least two months before it was publicly disclosed. The flaw allows an authenticated attacker with […]

    newssecurityaffairs.comJun 25, 2026, 9:17 AM
  • Cisco SD-WAN Zero-Day Exploited Months Before PatchingSecurityWeek

    CVE-2026-20245, the 7th Cisco SD-WAN vulnerability exploited in 2026, was used for months prior to its disclosure and patching.

    newswww.securityweek.comJun 25, 2026, 6:08 AM
  • Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN ManagerMandiant

    frastructure at a service provider. After gaining initial access, the threat actor exploited a zero-day vulnerability ( CVE-2026-20245 ) in Cisco Catalyst SD-WAN to escalate privileges from a compromised administrative account to root-level access. The vulnerability stems from the device’s file upload feature lacking the ability to properly filter mali

    vendorcloud.google.comJun 24, 2026, 11:00 AM
  • CVE-2026-20262: CISCO Catalyst SD-WAN Flaw Under Active Targeted ExploitationSecurity Affairs

    Cisco warned that CVE-2026-20262, a Catalyst SD-WAN Manager vulnerability allowing arbitrary file writes, is being actively exploited. Cisco confirmed active exploitation of CVE-2026-20262, an arbitrary file write vulnerability affecting Catalyst SD-WAN Manager. CVE-2026-20262 (CVSS score of 6.5) is an arbitrary file write vulnerability in the web interface of Cisco Catalyst SD-WAN Manager. The flaw is […]

    newssecurityaffairs.comJun 16, 2026, 10:53 AM
  • Cisco discloses second exploited SD-WAN vulnerability in two weeks (CVE-2026-20262)Help Net Security

    Cisco has revealed another Catalyst SD-WAN Manager vulnerability (CVE-2026-20262) that its Product Security Incident Response Team observed being exploited by attackers. But the associated security advisory also states that “the vulnerability was found during internal security testing”, raising the question of how attackers came to exploit it before Cisco had disclosed it publicly. The vulnerability (CVE-2026-20262) Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) is the management plane for the entire Cisco SD-WAN fabric. CVE-2026-20262 is … More →

    newswww.helpnetsecurity.comJun 16, 2026, 10:20 AM
  • Cisco Patches Another SD-WAN Zero-Day Exploited in AttacksSecurityWeek

    Cisco recently became aware of the exploitation of CVE-2026-20262, a Catalyst SD-WAN Manager zero-day that allows arbitrary file write.

    newswww.securityweek.comJun 16, 2026, 6:20 AM
  • U.S. CISA adds Cisco Catalyst SD-WAN, Arista Extensible Operating System (EOS), and Google Chromium V8 flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs

    U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Cisco Catalyst SD-WAN, Arista Extensible Operating System (EOS), and Google Chromium V8 flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added BerriAI LiteLLM and Check Point Security Gateway flaws to its Known Exploited Vulnerabilities (KEV) catalog. The two flaws added to […]

    newssecurityaffairs.comJun 10, 2026, 11:14 AM
  • No Patch Planned for Exploited Arista EOS VulnerabilitySecurityWeek

    Organizations are advised to apply vendor-supplied mitigations or discontinue the vulnerable devices.

    newswww.securityweek.comJun 10, 2026, 6:38 AM
  • Attackers exploiting unpatched Cisco SD-WAN flawCSO Online

    Cisco warns customers of an actively exploited high-severity vulnerability in Catalyst SD-WAN Manager, an enterprise network management system that has been targeted by hackers multiple times in the past. Located in the command-line interface, the flaw allows authenticated attackers to escalate privileges to root and take over the entire system. The vulnerability, tracked as CVE-2026-20245, […]

    newswww.csoonline.comJun 8, 2026, 9:48 PM
  • Week in review: Cisco SD-WAN 0-day exploited, Patch Tuesday forecastHelp Net Security

    Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: OWASP Agent Memory Guard: Stop AI agents from being weaponized through their own memory Agent Memory Guard is an open-source runtime defense layer that sits between an agent and its memory store, screening every read and write through a pipeline of detectors and a YAML policy. The project is the OWASP reference implementation for ASI06, Memory Poisoning, one entry in … More →

    newswww.helpnetsecurity.comJun 7, 2026, 8:00 AM
  • Cisco SD-WAN Has a New Root-Level Problem, and There’s No Fix YetSecurity Affairs

    Cisco warns of CVE-2026-20245 in SD-WAN Manager, a flaw that can lead to root access via file upload command injection; no patch or workaround yet. Cisco warns of a privilege escalation flaw, tracked as CVE-2026-20245 (CVSS base score of 7.8), in Cisco Catalyst SD-WAN Manager, the platform formerly known as SD-WAN vManage. An authenticated local […]

    newssecurityaffairs.comJun 5, 2026, 1:35 PM
  • Cisco SD-WAN 0-day exploited, no patch available (CVE-2026-20245)Help Net Security

    A 0-day privilege escalation vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager that has yet to be patched by Cisco is being leveraged by attackers. “To exploit this vulnerability, an attacker must have netadmin privileges on an affected system. This would require valid credentials or exploitation of CVE-2026-20182 or CVE-2026-20127. Cisco is not aware of successful exploitation by other methods,” the company shared on Thursday. It also said that it has observed “limited cases where the … More →

    newswww.helpnetsecurity.comJun 5, 2026, 8:44 AM
  • Cisco Warns of 7th SD-WAN Zero-Day Exploited in 2026SecurityWeek

    The vulnerability is tracked as CVE-2026-20245 and it can allow arbitrary command execution as root, but no patch yet.

    newswww.securityweek.comJun 5, 2026, 5:47 AM
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20245www.cisa.gov

    No excerpt available.

    Mitigationwww.cisa.govJun 4, 2026, 11:17 PM
  • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SWsec.cloudapps.cisco.com

    No excerpt available.

    Vendor Advisorysec.cloudapps.cisco.comJun 4, 2026, 11:17 PM
  • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzxsec.cloudapps.cisco.com

    No excerpt available.

    Vendor Advisorysec.cloudapps.cisco.comJun 4, 2026, 11:17 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence