CVE-2026-20245

Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability

HIGH

7.8

CVSS Score

Published: June 4, 2026 at 10:33 PM UTC

Updated: July 23, 2026 at 07:35 AM UTC

2 products affected across 1 vendorCatalyst Sd WAN ManagerSd WAN Vsmart Controller

Using Cisco Catalyst SD-WAN Manager by Cisco?

Get instant alerts when new vulnerabilities affect Cisco Catalyst SD-WAN Manager - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploitation

CISA KEV

Exploit prediction

EPSS 25%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score25.3%

EPSS (Exploit Prediction Scoring System) estimates a 25.3% chance this CVE is exploited in the wild within the next 30 days — higher than 98% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.

Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Ransomware Use

Unknown

Added to KEV

Jun 9, 2026

Remediation Due

Jun 23, 2026

125 days overdue

Notes

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx

https://nvd.nist.gov/vuln/detail/CVE-2026-20245

Description

A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user. To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices. Cisco recommends that customers upgrade to the fixed software that is documented in the that was published on May 14, 2026, and verify the configuration of the edge devices.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Catalyst Sd WAN Manager · Cisco

95%

v < 20.9.9.120.10 ≤ v < 20.12.5.420.12.6 ≤ v < 20.12.6.220.13 ≤ v < 20.15.4.420.15.5 ≤ v < 20.15.5.220.16 ≤ v < 20.18.2.226.1 ≤ v < 26.1.1.117.2.10 17.2.4 17.2.5 17.2.6 17.2.7 17.2.8 17.2.9 18.2.0 18.3.0 18.3.1 18.3.1.1 18.3.3 18.3.3.1 18.3.4 18.3.5 18.3.6 18.3.6.1 18.3.7 18.3.8 18.4.0 18.4.0.1 18.4.1 18.4.3 18.4.302 18.4.303 18.4.4 18.4.518.4.501_ES18.4.6 19.0.0 19.0.1a 19.1.0 19.2.0 19.2.097 19.2.098 19.2.099 19.2.1 19.2.2 19.2.3 19.2.31 19.2.32 19.2.4 19.2.4.0.1 19.2.4.0.8 19.2.4.0.9 19.2.929 19.3.0 20.1.1 20.1.1.1 20.1.12 20.1.2 20.1.2_937 20.1.3 20.1.3.1 20.10.1 20.10.1.1 20.10.1.220.10.1_LI_Images20.11.1 20.11.1.1 20.11.1.220.11.1_LI_Images20.12.120.12.1_LI_Images20.12.220.12.2_LI_Images20.12.3 20.12.3.120.12.3_LI_Images20.12.4 20.12.4.0.03 20.12.4.0.4 20.12.4.0.6 20.12.4.1 20.12.4.1_LI_Images 20.12.401 20.12.4_LI_Images20.12.4_Monthly_ES520.12.5 20.12.5.1 20.12.5.1.01 20.12.5.1_LI_Images 20.12.5.2 20.12.5.2_LI_Images 20.12.5.3 20.12.5.3_LI_Images 20.12.5.4 20.12.5.4_LI_ Images 20.12.501 20.12.5_LI_Images 20.12.6 20.12.6.1 20.12.6.1_LI_Images 20.12.6.2 20.12.6.2_LI_Images 20.12.6_LI_Images 20.12.7 20.12.7.1 20.12.7.1_LI_Images 20.12.7_LI_Images 20.13.120.13.1_LI_Images20.14.120.14.1_LI_Images20.15.1 20.15.1_LI_Images 20.15.2 20.15.2_LI_Images 20.15.3 20.15.3.1 20.15.3_ LI _Images 20.15.4 20.15.4.1 20.15.4.1_LI_Images 20.15.4.2 20.15.4.2_LI_Images 20.15.4.3 20.15.4.3_LI_Images 20.15.4.4 20.15.4.4_LI_Images 20.15.4_LI_Images 20.15.5 20.15.5.1 20.15.5.1_LI_Images 20.15.5.2 20.15.5.2_LI_Images 20.15.5_LI_Images 20.16.1 20.16.1_LI_Images 20.18.1 20.18.1_LI_Images 20.18.2 20.18.2.1 20.18.2.1_LI_Images 20.18.2.2 20.18.2.2_LI_Images 20.18.2_LI_Images 20.18.3 20.18.3_LI_Images 20.3.1 20.3.2 20.3.2.0.5 20.3.2.0.6 20.3.2.1 20.3.2.1_927 20.3.2.1_930 20.3.2_925 20.3.2_928 20.3.2_929 20.3.2_937 20.3.3 20.3.3.0.14 20.3.3.0.16 20.3.3.0.17 20.3.3.0.18 20.3.3.0.2 20.3.3.0.4 20.3.3.0.8 20.3.3.1 20.3.3.1.1 20.3.3.1.10 20.3.3.1.2 20.3.3.1.5 20.3.3.1.7 20.3.3.2 20.3.4 20.3.4.0.1 20.3.4.0.11 20.3.4.0.19 20.3.4.0.20 20.3.4.0.24 20.3.4.0.25 20.3.4.0.26 20.3.4.0.5 20.3.4.0.6 20.3.4.0.9 20.3.4.1 20.3.4.1.1 20.3.4.1.2 20.3.4.2 20.3.4.2.1 20.3.4.2.2 20.3.4.3 20.3.5 20.3.5.0.7 20.3.5.0.8 20.3.5.0.9 20.3.5.1 20.3.6 20.3.7 20.3.7.1 20.3.7.2 20.3.8 20.3.813 20.3.814 20.4.1 20.4.1.0.01 20.4.1.0.02 20.4.1.0.1 20.4.1.1 20.4.1.1.5 20.4.1.2 20.4.2 20.4.2.0.1 20.4.2.0.2 20.4.2.0.4 20.4.2.1 20.4.2.1.1 20.4.2.2 20.4.2.2.1 20.4.2.2.2 20.4.2.2.3 20.4.2.2.4 20.4.2.2.8 20.4.2.3 20.5.0.1.1 20.5.1 20.5.1.0.1 20.5.1.0.2 20.5.1.1 20.5.1.2 20.6.0.18.3 20.6.0.18.4 20.6.1 20.6.1.0.1 20.6.1.1 20.6.1.2 20.6.2 20.6.2.0.4 20.6.2.1 20.6.2.2 20.6.2.2.2 20.6.2.2.3 20.6.2.2.4 20.6.2.2.7 20.6.3 20.6.3.0.10 20.6.3.0.11 20.6.3.0.14 20.6.3.0.18 20.6.3.0.19 20.6.3.0.2 20.6.3.0.23 20.6.3.0.25 20.6.3.0.27 20.6.3.0.29 20.6.3.0.31 20.6.3.0.32 20.6.3.0.33 20.6.3.0.38 20.6.3.0.39 20.6.3.0.40 20.6.3.0.41 20.6.3.0.45 20.6.3.0.46 20.6.3.0.47 20.6.3.0.5 20.6.3.0.51 20.6.3.0.7 20.6.3.1 20.6.3.1.1 20.6.3.2 20.6.3.3 20.6.3.4 20.6.4 20.6.4.0.19 20.6.4.0.21 20.6.4.0.4 20.6.4.1 20.6.4.2 20.6.5 20.6.5.1 20.6.5.1.10 20.6.5.1.11 20.6.5.1.13 20.6.5.1.14 20.6.5.1.2 20.6.5.1.3 20.6.5.1.4 20.6.5.1.5 20.6.5.1.6 20.6.5.1.7 20.6.5.1.9 20.6.5.2 20.6.5.2.1 20.6.5.2.3 20.6.5.2.4 20.6.5.2.8 20.6.5.3 20.6.5.4 20.6.5.5 20.6.6 20.6.6.0.1 20.6.7 20.6.8 20.7.1 20.7.1.0.2 20.7.1.1 20.7.1EFT2 20.7.2 20.8.1 20.9.1 20.9.1.120.9.1EFT220.9.1_LI_Images20.9.2 20.9.2.0.01 20.9.2.1 20.9.2.2 20.9.2.3 20.9.2_LI_Images 20.9.3 20.9.3.0.12 20.9.3.0.16 20.9.3.0.17 20.9.3.0.18 20.9.3.0.2 20.9.3.0.20 20.9.3.0.21 20.9.3.0.23 20.9.3.0.24 20.9.3.0.25 20.9.3.0.26 20.9.3.0.29 20.9.3.0.3 20.9.3.0.4 20.9.3.0.5 20.9.3.0.7 20.9.3.0.8 20.9.3.1 20.9.3.2 20.9.3.2_LI_Images20.9.3_LI_ Images20.9.4 20.9.4.0.4 20.9.4.1 20.9.4.1.1 20.9.4.1.3 20.9.4.1.620.9.4.1_LI_Images20.9.4_LI_Images20.9.5 20.9.5.1 20.9.5.1.420.9.5.1_LI_Images20.9.5.2 20.9.5.2.1 20.9.5.2.13 20.9.5.2.14 20.9.5.2.16 20.9.5.2.21 20.9.5.2.720.9.5.2_LI_Images20.9.5.3 20.9.5.3_LI_Images20.9.5_LI_Images20.9.6 20.9.6.0.3 20.9.6_LI_Images 20.9.7 20.9.7.1 20.9.7.1_LI _Images 20.9.7_LI _Images 20.9.8 20.9.8.2 20.9.8.2_LI_Images 20.9.8_LI_Images 20.9.9 20.9.9.1 20.9.9.1_LI_Images 20.9.9_LI_Images 26.0.1 26.1.1 26.1.1.1 26.1.1.1_LI_Images 26.1.1_LI_Images

Affected range stops below 20.12.5.4, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.12.6.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.15.4.4, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.15.5.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.18.2.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.9.9.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 26.1.1.1, so it looks safe — our inference, not a vendor statement

Sd WAN Vsmart Controller · Cisco

95%

Affected range stops below 20.12.5.4, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.12.6.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.15.4.4, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.15.5.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.18.2.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.9.9.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 26.1.1.1, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (3)

Vendor Advisory

Source: cverecord

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx

Vendor Advisory

Source: cverecord

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW

US Government Resource

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20245

SSVC — Action Prioritization

SSVCActiveNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.8HIGHcisco

Attack Vector: LOCAL
Complexity: LOW
Privileges: LOW
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusANALYZED

CWE

CWE-116

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card