Cisco Vulnerability Exploited Months Before Disclosure, Google Warns

Google/Mandiant researchers observed threat actors exploiting multiple Cisco Catalyst SD‑WAN vulnerabilities — including a high‑severity zero‑day (CVE‑2026‑20245) that allowed root command execution via a malicious CSV upload and unauthorized peering/credential theft that enabled SSH access — to gain persistent, stealthy control of SD‑WAN infrastructure; Cisco disclosed the issue in early June and began releasing fixes after exploitation had already occurred months earlier.