Cisco SD-WAN Zero-Day Exploited Months Before Patching

A critical zero-day vulnerability in Cisco Catalyst SD-WAN Manager (CVE-2026-20245) was actively exploited by threat actors for months before Cisco released patches in June 2026, allowing attackers to escalate privileges to root on affected instances. The extended exploitation window highlights the danger of unpatched network infrastructure, particularly in service provider environments where a single compromise can cascade across multiple downstream clients. Attackers compounded the damage by manipulating credentials and deleting forensic evidence, undermining incident response efforts. This case demonstrates that even without a vendor patch available, organizations must employ compensating controls and aggressive monitoring to detect and contain exploitation attempts. The targeting of SD-WAN infrastructure underscores how network management planes are high-value targets that require heightened protection.