Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access

A threat actor exploited a zero-day vulnerability in Cisco Catalyst SD-WAN (CVE-2026-20245) at least two months before it was publicly known, gaining root-level access and creating a rogue user account at a communications service provider. This incident exemplifies the extreme danger of zero-day exploitation against edge network devices, which sit at the perimeter of critical infrastructure and often have broad network access. The attacker's use of anti-forensic techniques to erase evidence underscores the need for robust, tamper-resistant logging that extends beyond the compromised device itself. Edge network appliances are increasingly prime targets because a single compromise can provide persistent, privileged access to downstream systems and customer environments.