ZeroDay Findings
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-20245

Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability

Published Jun 4, 2026 · catalog updated Jul 23, 2026 · Cisco Catalyst SD-WAN Manager

Patch now

CVE-2026-20245 is in the CISA known-exploited catalog, due Jun 23, 2026. Confirm Cisco Catalyst SD-WAN Manager against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Severity
High7.8
Known exploitation
CISA KEV and VulnCheck KEV
EPSS
25.32%
Remediation
Remediation guidance
Affected products
cpe cisco/catalyst sd-wan manager · vendor Cisco Catalyst SD-WAN Manager

A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user. To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices. Cisco recommends that customers upgrade to the fixed software that is documented in the that was published on May 14, 2026, and verify the configuration of the edge devices.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe cisco/catalyst sd-wan manager20.12.7
  • vendor Cisco Catalyst SD-WAN Managerversion unspecified

How to fix CVE-2026-20245

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2026-20245 is in the CISA known-exploited catalog, due Jun 23, 2026. Confirm Cisco Catalyst SD-WAN Manager against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Which versions are affected?

Compare what you have installed with cisco/catalyst sd-wan manager 20.12.7. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

What should an analyst verify?

CWE-116. EPSS 25.32%. The CISA KEV listing is the exploitation evidence. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Cisco security

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 4, 2026 · Catalog

    Detected

    A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-

  2. Jun 9, 2026 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Jun 23, 2026 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Jul 23, 2026 · Catalog

    Updated

    A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-

Sources

  • CISA KEVConfirmed exploitationCVE-2026-20245

    Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2026-20245

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-20245

    30-day exploitation probability 25.3%

    first.org
  • Google Threat IntelligenceThreat researchCVE-2026-20245

    Research mention from Google Threat Intelligence. Not confirmation of exploitation.

    cloud.google.com
  • NIST NVDVulnerability recordCVE-2026-20245

    A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands a

    nvd.nist.gov
  • VulnCheck KEVConfirmed exploitationCVE-2026-20245

    Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.

    vulncheck.com

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.