CVE-2026-20245
Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability
Description
CVE-2026-20245 is a high-severity command injection vulnerability in the CLI of Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart), Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage), and Cisco Catalyst SD-WAN Validator (formerly SD-WAN vBond). It allows an authenticated, local attacker with netadmin privileges to execute arbitrary commands as root by supplying a crafted file to the affected system. The root cause is insufficient validation of user-supplied input, which lets an uploaded file drive command injection and privilege escalation to root. CVE-2026-20245 is rated CVSS 7.8 (High) and is listed in the CISA KEV catalog. Cisco has observed limited cases where exploitation resulted in configuration changes pushed to edge devices, so operators should upgrade to the fixed software and verify edge-device configuration.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | catalyst sd-wan manager | < 20.9.9.1; >= 20.10, < 20.12.5.4; >= 20.12.6, < 20.12.6.2; >= 20.13, < 20.15.4.4; >= 20.15.5, < 20.15.5.2; >= 20.16, < 20.18.2.2; >= 26.1, < 26.1.1.1; 20.12.7 |
| cisco | sd-wan vsmart controller | < 20.9.9.1; >= 20.10, < 20.12.5.4; >= 20.12.6, < 20.12.6.2; >= 20.13, < 20.15.4.4; >= 20.15.5, < 20.15.5.2; >= 20.16, < 20.18.2.2; >= 26.1, < 26.1.1.1; 20.12.7 |
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx(Vendor Advisory)
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20245(US Government Resource)
Weakness Type
CWE-116: Improper Encoding or Escaping of Output
CVE-2026-20245 is classified under CWE-116 — Improper Encoding or Escaping of Output. The CLI builds a system command incorporating the contents of a user-supplied file without properly escaping it for the shell context, so attacker-controlled data alters the structure of the executed command. This improper shell escaping is the root cause of the resulting command injection and root-level execution.
Learn more: CWE-116 — Improper Encoding or Escaping of Output
Impact Analysis
CVE-2026-20245 carries a CVSS 3.1 base score of 7.8 (High). Attack Vector (Local): exploitation requires CLI access to the affected system rather than a purely remote network path. Attack Complexity (Low): no special conditions are needed once access is obtained. Privileges Required (Low): the attacker must hold a valid netadmin account, so this is a privilege-escalation primitive rather than an unauthenticated takeover. User Interaction (None): no victim action is required. Confidentiality, Integrity and Availability (High): executing commands as root grants full control of the controller, including the ability — observed by Cisco in limited cases — to push configuration changes to managed edge devices, amplifying the impact across the SD-WAN fabric. With an EPSS score of about 1% (57th percentile) and confirmed KEV listing, the practical risk is escalation from an administrative account to root and potential fabric-wide configuration tampering.
Exploit Maturity
CISA has added CVE-2026-20245 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, and Cisco notes limited observed cases where exploitation resulted in configuration changes to edge devices. The references list the Cisco vendor advisories and the KEV entry, with no public exploit code linked, and the EPSS score is about 1% (57th percentile). Because exploitation requires a netadmin account and local CLI access, the immediate population at risk is narrower than for unauthenticated flaws, but the confirmed exploitation and root-level outcome justify prompt patching.
Remediation
- Follow Cisco's and CISA's required action and upgrade the affected Catalyst SD-WAN Manager, vSmart Controller, and Validator components to the fixed software documented in the Cisco security advisory.
- Match each running version to the corresponding fixed release from the affected ranges (for example, fixed trains include 20.9.9.1, 20.12.5.4, 20.12.6.2, 20.15.4.4, 20.15.5.2, 20.18.2.2, and 26.1.1.1).
- Following Cisco's guidance, verify the configuration of edge devices, since exploitation has in limited cases pushed configuration changes to them.
- Tightly control and audit netadmin-level access to the SD-WAN CLI, as a valid netadmin account is the precondition for exploitation.
- As long-term hardening, ensure the CLI uses parameterized command APIs and proper escaping for any data derived from uploaded files, so user input cannot alter command structure (per the CWE-116 guidance).
Technical Details
The vulnerability stems from CWE-116 (Improper Encoding or Escaping of Output): the SD-WAN CLI incorporates the contents of a user-supplied file into a system command without correctly escaping shell-significant characters, the root cause of command injection. As reflected in the CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, an authenticated local attacker with netadmin privileges uploads a crafted file whose contents inject additional commands; when the CLI processes the file, those commands run as the root user, elevating the attacker's privileges. Because the affected systems manage the SD-WAN fabric, root on the controller can translate into configuration changes pushed to edge devices, which Cisco has observed in limited cases.
Frequently Asked Questions
Is CVE-2026-20245 being actively exploited?
Yes. CVE-2026-20245 is listed in CISA's Known Exploited Vulnerabilities catalog, and Cisco has observed limited cases of exploitation that pushed configuration changes to edge devices. Its EPSS score is about 1% (57th percentile), but the KEV listing is the decisive signal.
What products are affected by CVE-2026-20245?
Cisco Catalyst SD-WAN Manager (formerly vManage), Catalyst SD-WAN Controller (formerly vSmart), and Catalyst SD-WAN Validator (formerly vBond) are affected across multiple trains, including versions below 20.9.9.1, 20.12.5.4, 20.12.6.2, 20.15.4.4, 20.15.5.2, 20.18.2.2, and 26.1.1.1.
How do I fix CVE-2026-20245?
Upgrade the affected SD-WAN components to the fixed software documented in the Cisco security advisory, choosing the release that corresponds to your current train, and verify edge-device configuration afterward.
How severe is CVE-2026-20245?
It is rated High with a CVSS 3.1 base score of 7.8. It requires an authenticated netadmin account and local CLI access, but it yields root-level command execution and can lead to configuration changes on edge devices, and it is confirmed as actively exploited.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.