Hackers Exploiting Cisco Catalyst SD-WAN Manager 0-Day Flaw to Gain Root-Level Access

## Executive summary A sophisticated, likely state-sponsored threat actor conducted an active campaign against Cisco Catalyst SD-WAN Manager, leveraging multiple flaws including an authenticated zero-day (CVE-2026-20245) in the CLI file-upload path to inject a UID 0 'troot' account via a crafted CSV, escalate to root, exfiltrate management-plane device configurations, and then clean up forensic artifacts; the report includes IoCs (several IPs), affected releases, and urgent mitigation steps (specific fixed versions, log collection, IOC sweeps, and contacting Cisco TAC).