Mandiant has disclosed details on how attackers exploited a zero-day vulnerability in Cisco Catalyst SD-WAN devices, tracked as CVE-2026-20245, to gain root-level access. The flaw allowed unauthorized actors to create rogue root accounts on targeted systems, enabling persistent control.
The vulnerability carries a critical severity rating, though no CVSS score was specified in the reports. Dark Reading notes that evidence suggests the exploit was deployed in attacks up to two months before Cisco publicly disclosed the issue. The number of affected devices and victims remains unspecified, but active exploitation has been confirmed.
Attackers achieved initial access through a technique known as rogue peering, connecting to the victim's SD-WAN network to escalate privileges. Once inside, they leveraged the flaw to obtain root-level access, bypassing standard authentication mechanisms. Indicators of compromise include unauthorized root account creation on SD-WAN controllers.
Cisco has since released a security advisory with patches for affected versions, though no specific workarounds were detailed in the sources. Mandiant recommends immediate application of updates and monitoring for anomalous root account activity on SD-WAN infrastructure.
Attribution for the attacks remains unclear; Mandiant did not name a specific threat actor. The incident underscores a growing trend of zero-day exploits targeting enterprise networking gear, with attackers striking before vendors can issue patches.