EXPOSURES › CVE-2026-20245
CVE-2026-20245
HIGH ⌖ ON CISA KEV · EXPLOITEDCisco SD-WAN Manager allows authenticated local attackers to execute arbitrary root commands via crafted file uploads.
This vulnerability enables local privilege escalation to root via improper output encoding, posing a severe risk to DIB organizations relying on Cisco SD-WAN infrastructure for network segmentation and control. While requiring local authentication, the ability to execute arbitrary commands as root significantly undermines the integrity of the management plane, necessitating immediate patching and strict access controls.
Shame score — A local privilege escalation vulnerability in a widely deployed network management product that was actively exploited but did not involve remote exploitation or zero-day disclosure.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.
| PRODUCT | STATUS |
|---|---|
| AppDynamics GovAPM AppDynamics (a Cisco company) |
Authorized |
| Cisco Cloudlock for Government Cisco Systems Inc. |
Authorized |
| Cisco Meraki for Government Cisco Systems Inc. |
In Process |
| Cisco SD-WAN for Government Cisco Systems Inc. |
In Process |
| Cisco Umbrella for Government Cisco Systems Inc. |
In Process |
| Cisco Unified Communications Manager Cloud for Government (Cisco UCM Cloud for Government) Cisco Systems Inc. |
Authorized |
| Duo Federal Duo Security (A Cisco Company) |
Authorized |
| WebEx Contact Center Enterprise for Government (WxCCE-G) Cisco Systems Inc. |
In Process |
| Webex for Government Cisco Systems Inc. |
Authorized |