Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access

Attackers exploited CVE-2026-20245, a command injection zero-day in Cisco Catalyst SD-WAN, by uploading a specially crafted file to gain root-level access on targeted devices. The attack chain likely began with unauthorized SD-WAN peering connections, suggesting adversaries chained this vulnerability with previously known authentication bypass flaws — a hallmark of sophisticated, multi-stage exploitation. Zero-day vulnerabilities in network edge devices are particularly dangerous because they sit at the perimeter of organizational infrastructure and are often exposed to the internet. This incident underscores the critical need for proactive vulnerability management, strict access controls on network management interfaces, and rapid detection of anomalous peering or authentication events.