One CSV Upload From Root: Inside CVE-2026-20245 on Cisco Catalyst SD-WAN Manager

The gap between two posts

The UAT-8616 post covered two maximum-severity Catalyst SD-WAN authentication bypasses. The hardening-release post covered Cisco’s August internal security review. Between those two, in June, Cisco patched a third bug that deserves its own writeup: CVE-2026-20245, a privilege escalation in Catalyst SD-WAN Manager that turns an already-authenticated admin session into a full root shell. Mandiant found it being exploited in the wild, wrote it up in detail on June 24, and named the parts an attacker actually touched: a rogue peering connection, a password changed and changed back, a file called evil_tenant.csv, and a new root account called troot.

What the bug actually is

Catalyst SD-WAN Manager’s command-line interface has a request tenant-upload command for loading tenant configuration data from a CSV file. CVE-2026-20245 (CVSS 7.8, CWE-116, improper encoding or escaping of output) is a failure to properly filter that file’s contents before acting on it. An attacker who already has an authenticated session, even a lower-privileged one, can supply a CSV file whose contents aren’t just tenant data but a shell script, and have it executed as root. Mandiant’s writeup names the mechanism plainly without publishing the payload script itself, and this post is following the same line: naming what happened, not reproducing how to do it.

What that access bought the attacker in the real intrusion Mandiant tracked, per their published account: a new user account added directly to /etc/passwd and /etc/shadow with root’s UID and GID, reachable afterward with an ordinary su. Cisco credits Mandiant with the report, and their advisory (cisco-sa-sdwan-privesc-4uxFrdzx) lists fixed releases at 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, and 26.1.1.2. It’s on CISA’s Known Exploited Vulnerabilities list.

The intrusion Mandiant actually found

The full timeline, as Mandiant published it, is worth walking through, because the interesting part isn’t the privilege escalation bug in isolation, it’s what came before it.

From late 2025 into January 2026, Mandiant observed unauthorized peering connections to the victim’s SD-WAN Manager devices. It’s possible these used CVE-2026-20127 or CVE-2026-20182, the two bypasses this site’s UAT-8616 post already covered, but Mandiant is explicit that this isn’t confirmed. In March 2026, a second wave of rogue peering connections appeared on a device that Cisco confirmed was not vulnerable to CVE-2026-20182, and Cisco’s own assessment is that this later access likely used stolen certificate material from an earlier compromise instead. Mandiant states outright that it’s unclear whether the same threat actor was behind both waves. That matters for anyone tempted to read this as a straightforward “UAT-8616 did this too” story: the public reporting doesn’t say that, and neither should this post.

Once inside via that rogue peering, the attacker authenticated over SSH as vmanage-admin, then used that session to change the password on the default admin account, log in through the web interface as admin, pull configuration data, and change the admin password back to what it was before logging off, an anti-forensic step aimed squarely at an administrator who might glance at the account during routine checks. Neither vmanage-admin nor admin has root shell access on its own. In April 2026, from that same admin session, the attacker exploited CVE-2026-20245 by uploading the crafted CSV, which created the troot account and dropped in root privileges. Mandiant then observed the account being reached with su.

What happened next is arguably the more interesting half of the report: the attacker deleted the files they’d created, restored the configuration state their exploit had backed up before overwriting, and ran a validation script whose entire purpose was checking that all of that cleanup had actually worked. That’s a level of operational discipline that goes well past “get root and move on.”

The patch treadmill, one CVE further back

The hardening-release post already found that every train Cisco patched in May’s emergency CVE-2026-20182 response had moved again by August. CVE-2026-20245 sits in between those two disclosures chronologically, and its own fixed-release table follows the same pattern: 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, and 26.1.1.2, each one step ahead of where May’s emergency fix left that same train, and each one a step behind where August’s hardening release would eventually take it. Three advisories, three months apart, the same handful of trains climbing every time. An administrator who patched in May and again in June was still due another round in August. That’s not a criticism of the cadence, vulnerabilities get found when they get found, but it’s a genuine pattern worth naming for anyone running this platform: patching against the most recent advisory doesn’t mean patching is done.

What this adds to the picture

Put next to the UAT-8616 post, the shape of the risk is clearer than either bug tells on its own. An attacker doesn’t need every step to come from a single named campaign to end up in the same place: rogue peering (from whatever source) buys initial access, a stolen or manipulated admin credential buys persistence and cover, and a bug like CVE-2026-20245 turns that admin-level foothold into root on the box that runs the entire SD-WAN fabric’s control plane. Mandiant’s own framing calls this “living off the edge”, attackers going after network appliances specifically because they’re a management blind spot: often short on the logging and telemetry a compromised server would have, and central enough that owning one is worth the effort.

For detection, Mandiant’s published guidance is worth reading directly rather than summarizing away the specifics, but the shape of it fits a pattern this site keeps coming back to: watch for su to an account that shouldn’t exist, watch for password changes that get quietly reverted within minutes, and watch for a device’s own script logs recording activity nobody scheduled. The three-planes framing applies here as directly as it did for UAT-8616’s bugs: this is a control-plane compromise, and the whole reason it’s worse than an ordinary root shell on an ordinary server is what the control plane is trusted to do next.