DaystoPatch

CiscoExploited incident

Cisco Catalyst SD-WAN Controller, Manager, and Validator Authenticated Privilege Escalation Vulnerability

CVE-2026-20245High, CVSS 7.8In CISA's Known Exploited Vulnerabilities catalog since 9 Jun 2026

  • Exploited before a fix
FixedFixed for every supported version 7.9 days after the first public report.

Response

Silence
0h
First public report to first vendor statement
Exposure
5.9d
First public report to first fix
Follow-through
7.9d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Cisco advisory cisco-sa-sdwan-privesc-4uxFrdzxClaimedQuote verified

    Initial public release.

    Vendor advisory was the first public report.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:10ff55d8e7d937ee…
    Used in metrics
    Yes
    Dispute this timestamp
    7 more sources for this moment
    Cisco advisory cisco-sa-sdwan-privesc-4uxFrdzxClaimedQuote verified4 Jun 2026, 22:27 UTC

    Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator Authenticated Privilege Escalation Vulnerability

    The vendor's own disclosure.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:bd3c3f60f158ff60…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco PSIRT advisory cisco-sa-sdwan-privesc-4uxFrdzx, v1.0 Interim (Wayback snapshot 2026-06-05)CuratedQuote verified4 Jun 2026, 22:27 UTC

    In June 2026, the Cisco Product Security Incident Response Team (PSIRT) became aware of exploitation of this vulnerability.

    Exploitation was first disclosed by v1.0 ('First Published: 2026 June 4 22:27 GMT'), which shipped with no fix. Mandiant's write-up (Google Cloud blog, 2026-06-24) came later and says the bug was used as a zero-day months earlier.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:bd1cd363e46a15e7…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-20245ClaimedQuote verified4 Jun 2026, 22:33 UTC

    A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:cde2460410546592…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet5 Jun 2026, 00:01 UTC

    🟠 CVE-2026-20245 - High (7.8)

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-20245)ClaimedQuote verified9 Jun 2026

    Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability

    Added to CISA's KEV catalog on 2026-06-09.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Research: gtiClaimedQuote verified24 Jun 2026

    Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager

    Earliest mention we hold (a vetted outlet).

    Source
    Research: gti research
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:1795a465fad9f52e…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet26 Jun 2026, 10:30 UTC

    📢 Exploitation zero-day CVE-2026-20245 dans Cisco Catalyst SD-WAN par un acteur inconnu 📝 ## 🔍 Contexte Publié le 24 juin 2026 par Mandiant (Google Cloud Blog), c... 📖 cyberveille : https:// cyberveille.ch/posts/2026-06-2

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Cisco advisory cisco-sa-sdwan-privesc-4uxFrdzxClaimedQuote verified

    Initial public release.

    From the advisory's revision history.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:10ff55d8e7d937ee…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Cisco PSIRT advisory cisco-sa-sdwan-privesc-4uxFrdzxCuratedQuote not checked yet4 Jun 2026, 22:27 UTC

    First Published: 2026 June 4 22:27 GMT

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    +5.9d

    Cisco CSAF for cisco-sa-sdwan-privesc-4uxFrdzx, revision 1.5.0CuratedQuote verified

    Updated fixed release table to include additional affected trains and fix availability for Release 26.1.1.2.

    CSAF revision_history entry number 1.5.0 is dated 2026-06-10T19:39:26+00:00. v1.0 said 'Cisco has not released software updates that address this vulnerability.' Revision 1.4.0 (2026-06-09T14:34:36+00:00) 'Updated affected products and fixed releases.'; no snapshot of 1.4 exists, so we cannot tell whether it already listed a fix (for example 20.18.3.1).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:bd3c3f60f158ff60…
    Used in metrics
    Yes
    Dispute this timestamp
    6 more sources for this moment
    Cisco advisory cisco-sa-sdwan-privesc-4uxFrdzxClaimedQuote verified9 Jun 2026, 14:34 UTC

    Updated affected products and fixed releases.

    CaveatRevision adds fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:10ff55d8e7d937ee…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco advisory cisco-sa-sdwan-privesc-4uxFrdzxClaimedQuote verified10 Jun 2026, 19:39 UTC

    Updated fixed release table to include additional affected trains and fix availability for Release 26.1.1.2.

    CaveatRevision adds fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:10ff55d8e7d937ee…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco advisory cisco-sa-sdwan-privesc-4uxFrdzxClaimedQuote verified10 Jun 2026, 21:01 UTC

    Updated fixed release table for Release 26.1.1.1.

    CaveatRevision adds fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:10ff55d8e7d937ee…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco advisory cisco-sa-sdwan-privesc-4uxFrdzxClaimedQuote verified11 Jun 2026, 19:14 UTC

    Updated fixed release table with Releases 20.15.4.5 and 20.15.5.3.

    CaveatRevision adds fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:10ff55d8e7d937ee…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco advisory cisco-sa-sdwan-privesc-4uxFrdzxClaimedQuote verified12 Jun 2026, 20:36 UTC

    Updated fixed release table with Releases 20.9.9.2 and 20.12.7.2. Changed advisory status from interim to final.

    CaveatRevision adds fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:10ff55d8e7d937ee…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco advisory cisco-sa-sdwan-privesc-4uxFrdzxClaimedQuote verified21 Jul 2026, 16:01 UTC

    Added 20.18.2.2 and earlier to the Fixed Releases table.

    CaveatRevision adds fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:10ff55d8e7d937ee…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    +7.9d

    Cisco CSAF for cisco-sa-sdwan-privesc-4uxFrdzx, revision 1.8.0CuratedQuote verified

    Updated fixed release table with Releases 20.9.9.2 and 20.12.7.2. Changed advisory status from interim to final.

    CSAF revision 1.8.0 is dated 2026-06-12T20:36:49+00:00. The Wayback snapshot of 2026-06-12 00:05 UTC (v1.7) still shows 'Future release' for 20.9.9.1-and-earlier and 20.12.7.1-and-earlier; the 2026-06-16 snapshot (v1.8) shows 20.9.9.2 and 20.12.7.2. Staggered fixes: 26.1.1.2 (1.5.0, 06-10 19:39), 26.1.1.1 row (1.6.0, 06-10 21:01), 20.15.4.5 and 20.15.5.3 (1.7.0, 06-11 19:14), 20.9.9.2 and 20.12.7.2 (1.8.0, 06-12 20:36). Revision 1.10.0 (2026-07-21) only added the '20.18.2.2 and earlier' row, pointing to the already-available 20.18.3.1.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:bd3c3f60f158ff60…
    Used in metrics
    Yes
    Dispute this timestamp

This advisory changed after publication

  1. cisco-sa-sdwan-privesc-4uxFrdzx

    Recorded in the revision history

    Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator Authenticated Privilege Escalation Vulnerability

    Version table: 1 row added. One new row reads "20.18.2.2 and earlier | 20.18.3.1".

    • Fixed versions
    Version table rows
    Beforenot present
    After20.18.2.2 and earlier | 20.18.3.1
    Verbatim wording. Removed text is struck through. Added text is bold.
    Before

    Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator Authenticated Privilege Escalation Vulnerability Cisco Security Advisory Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator Authenticated Privilege Escalation Vulnerability High Advisory ID: cisco-sa-sdwan-privesc-4uxFrdzx First Published: 2026 June 4 22:27 GMT Last Update

    After

    t Fixed Release 20.9.9.1 and earlier | 20.9.9.2 20.12.7.1 and earlier | 20.12.7.2 20.15.4.4 and earlier | 20.15.4.5 20.15.5.2 and earlier | 20.15.5.3 20.18.2.2 and earlier | 20.18.3.1 20.18.3 | 20.18.3.1 26.1.1.1 and earlier | 26.1.1.2 The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory. Exploitatio

    Earlier version captured 16 Jun 2026, 13:41 UTC: archived copyLater version captured 22 Jul 2026, 05:48 UTC: archived copyRecovered from archived copiesSnapshots 049948b616… and 10ff55d8e7…Incident page

  2. cisco-sa-sdwan-privesc-4uxFrdzx

    Recorded in the revision history

    Cisco Catalyst SD-WAN Controller, Catalyst SD-WAN Manager, and Catalyst SD-WAN Validator Authenticated Privilege Escalation Vulnerability

    Version table: 2 rows added and 2 rows removed. One new row reads "20.9.9.1 and earlier | 20.9.9.2".

    • Fixed versions
    Version table rows
    Before20.9.9.1 and earlier | Future release; 20.12.7.1 and earlier | Future release
    After20.9.9.1 and earlier | 20.9.9.2; 20.12.7.1 and earlier | 20.12.7.2
    Earlier version captured 12 Jun 2026, 00:05 UTC: archived copyLater version captured 16 Jun 2026, 13:41 UTC: archived copyRecovered from archived copiesSnapshots 6eec2f38bd… and 049948b616…Incident page

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Cisco Catalyst SD-WAN Manager
  • Cisco Catalyst SD-WAN Controller
  • Cisco Catalyst SD-WAN Validator
How we built this timeline

Zero-day at disclosure: v1.0 (Interim) disclosed exploitation with no fix; fixes arrived per train over 10 Jun 2026..06-12 (times from the advisory's CSAF revision_history). Exploitation requires netadmin privileges, which Cisco says would require valid credentials or exploitation of CVE-2026-20182 or CVE-2026-20127.

Reported by Mandiant (Chester Sng, Pete Boonyakarn, Logeswaran Nadarajan). A Live Protect shield was added in 1.9.0 (15 Jul 2026), after all fixes.

Media described it as the seventh exploited Cisco SD-WAN zero-day of 2026.

Related

Cisco report card