DaystoPatch

CiscoExploited incident

Cisco SD-WAN Software CLI Privilege Escalation Vulnerability (2022), exploited in the UAT-8616 campaign

CVE-2022-20775High, CVSS 7.8In CISA's Known Exploited Vulnerabilities catalog since 25 Feb 2026

  • Exploited after a fix existed
FixedFixed for every supported version under an hour after the first public report.

Response

Silence
0h
First public report to first vendor statement
Exposure
<1h
First public report to first fix
Follow-through
<1h
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Cisco advisory cisco-sa-sd-wan-priv-E6e8tEdFClaimedQuote verified

    Initial public release.

    Vendor advisory was the first public report.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:4b0d788d9aa48618…
    Used in metrics
    Yes
    Dispute this timestamp
    6 more sources for this moment
    Cisco PSIRT advisory cisco-sa-sd-wan-priv-E6e8tEdFCuratedQuote not checked yet28 Sep 2022, 16:00 UTC

    Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges.

    Coordinated disclosure, 'First Published: 2022 September 28 16:00 GMT'. Exploitation was reported only in 2026 (see the second world candidate).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2022-20775ClaimedQuote verified30 Sep 2022, 18:45 UTC

    A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b9f08598255d0843…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2022-20775)ClaimedQuote verified25 Feb 2026

    Cisco SD-WAN Path Traversal Vulnerability

    Added to CISA's KEV catalog on 2026-02-25.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet25 Feb 2026, 16:56 UTC

    Latest post from CISA

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco CSAF for cisco-sa-sd-wan-priv-E6e8tEdF, revision 1.2.0CuratedQuote verified25 Feb 2026, 20:29 UTC

    Updated exploitation status.

    CSAF revision 1.2.0 is dated 2026-02-25T20:29:00+00:00; the advisory now reads 'In February 2026, the Cisco PSIRT became aware of attempted exploitation of the vulnerability described in CVE-2022-20775.' Same day as Talos's UAT-8616 post (https://blog.talosintelligence.com/uat-8616-sd-wan/).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:97fd9685644da686…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet14 Jun 2026, 00:00 UTC

    📢 Cisco SD-WAN Manager : élévation de privilèges root via injection de commande, sans correctif disponible 📝 📰 **Source** : SecurityAffairs — **Date... 📖 cyberveille : https://

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Cisco advisory cisco-sa-sd-wan-priv-E6e8tEdFClaimedQuote verified

    Initial public release.

    From the advisory's revision history.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:4b0d788d9aa48618…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Cisco PSIRT advisory cisco-sa-sd-wan-priv-E6e8tEdFCuratedQuote verified28 Sep 2022, 16:00 UTC

    First Published: 2022 September 28 16:00 GMT

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:4b0d788d9aa48618…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    +<1h

    Cisco PSIRT advisory cisco-sa-sd-wan-priv-E6e8tEdFCuratedQuote verified

    Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.

    Fixed releases for CVE-2022-20775: 20.6.3, 20.7.2, 20.8.1 (20.9 not affected; 18.4, 19.2 and 20.3 must migrate). Revision 1.1 (CSAF 2022-09-29T21:59:32+00:00) changed the 20.6 first fix from 20.6.4 to 20.6.3, i.e. to an earlier release, which does not move these moments.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:4b0d788d9aa48618…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Cisco advisory cisco-sa-sd-wan-priv-E6e8tEdFClaimedQuote verified29 Sep 2022, 21:59 UTC

    Updated first fixed release from 20.6.4 to 20.6.3 for CVE-2022-20775.

    CaveatRevision adds fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:4b0d788d9aa48618…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    +<1h

    Cisco PSIRT advisory cisco-sa-sd-wan-priv-E6e8tEdFCuratedQuote verified

    First Published: 2022 September 28 16:00 GMT

    Every non-migrate train in the table (20.6, 20.7, 20.8) had a fixed release at publication.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:4b0d788d9aa48618…
    Used in metrics
    Yes
    Dispute this timestamp

This advisory changed after publication

  1. cisco-sa-sd-wan-priv-E6e8tEdF

    Recorded in the revision history

    Cisco SD-WAN Software Privilege Escalation Vulnerabilities

    Advisory now says the bug is exploited (earlier version: vendor not aware).

    • Exploitation status
    Exploitation status
    Beforevendor not aware of exploitation
    Aftervendor aware of exploitation
    Earlier version captured 18 Apr 2025, 18:41 UTC: archived copyLater version captured 26 Feb 2026, 08:24 UTC: archived copyRecovered from archived copiesSnapshots f9c7564541… and c695b8df9b…Incident page

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Cisco SD-WAN Software (vManage, vSmart, vBond, vEdge CLI)
How we built this timeline

Split from cisco-cve-2026-20127 under R7 (correction pass 23 Oct 2026): Talos reports UAT-8616 downgraded SD-WAN software to exploit this 2022 bug after gaining access via CVE-2026-20127, but the two were disclosed more than 14 days apart. Old bug added to KEV on 25 Feb 2026. exploited before a fix=false under R4: fixed in 2022, exploitation first reported 25 Feb 2026.

Exploitation in the campaign depended on downgrading devices to vulnerable releases. The same advisory covers CVE-2022-20818 (not in KEV).

Reported by Cyrille Chatras (Orange Group / Orange CERT-CC).

Related

No related incidents.

Cisco report card