Cisco SD-WAN Zero-Day Exploited in Attacks

Mandiant documented an active exploitation of a Cisco Catalyst SD-WAN Manager zero-day (CVE-2026-20245) that allowed attackers to escalate from a compromised admin account to root by uploading a crafted CSV to bypass file-upload filtering and manipulating default credentials; the intrusion targeted a service provider, included anti-forensic actions, and the report urges immediate upgrades to specified fixed releases, active IOC hunting (e.g., using `request admin-tech`), and contacting Cisco TAC if suspicious activity is found.