This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Cisco Catalyst SD-WAN Manager warns of 1 vulnerability

Cisco has observed limited exploitation of the high-severity vulnerability CVE-2026-20245, leading to configuration changes on end devices [1][2]. Neither a direct fix nor a mitigation is available yet. Cisco therefore recommends updating to the fixed software version listed in the Catalyst SD-WAN security advisory for CVE-2026-20182 and verifying the configuration of end devices [3]. On 9 June 2026, a fix was released in version 20.18.3.1 [1]. We recommend updating without delay.

Cisco Catalyst SD-WAN Manager - authenticated privilege escalation (CVE-2026-20245)
CVSS 7.8 (High)

An authenticated local attacker with netadmin privileges can execute arbitrary commands using a crafted file and escalate their privileges to root due to insufficient validation of user input in the Cisco Catalyst SD-WAN Manager CLI [1].

The vulnerability is present in products:

  • On-Prem Deployment;
  • Cisco SD-WAN Cloud-Pro;
  • Cisco SD-WAN Cloud (Cisco Managed);
  • Cisco SD-WAN for Government (FedRAMP);

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X

More information:

The vulnerability was publicly disclosed 4. 6. 2026.

By CESNET, z.s.p.o. Michaela Jarošová on 8. 6. 2026.

CESNET, z.s.p.o. Logo