Cisco customers encounter another SD-WAN zero-day under attack

Cisco disclosed an actively exploited zero-day (CVE-2026-20245) in Catalyst SD‑WAN Manager that allows authenticated or local attackers to perform command-injection leading to root-level command execution; a patch is not yet available, Cisco provided limited indicators of compromise, and exploitation appears to often require valid credentials or chaining from earlier SD‑WAN vulnerabilities (e.g., CVE-2026-20182 / CVE-2026-20127).