Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited Months Before Disclosure

Mandiant reported that an unknown actor exploited a Cisco Catalyst SD-WAN zero-day (CVE-2026-20245, CVSS 7.8) months before public disclosure to escalate netadmin accounts to root by uploading a crafted file (evil_tenant.csv). The intrusions against a communications service provider involved creating a rogue 'troot' account, anti-forensic cleanup of created files and configuration changes, and possibly reuse of stolen certificates or earlier authentication bypasses (CVE-2026-20127, CVE-2026-20182); Cisco has released fixes and confirmed active exploitation across deployment models.