Cisco SD-WAN Zero-Day Exploited Two Months Before Disclosure
Mandiant reports unknown threat actor gained root access via CVE-2026-20245, exploiting the flaw as a zero-day before Cisco's public advisory.
An unidentified threat actor exploited a high-severity vulnerability in Cisco Catalyst SD-WAN at least two months before its public disclosure, according to Mandiant. The flaw, designated CVE-2026-20245 and carrying a CVSS score of 7.8, permits authenticated local attackers to execute arbitrary commands with elevated privileges.
The zero-day exploitation window represents a significant operational security failure. Attackers with initial local access could escalate to root-level control, enabling persistent access, lateral movement, and data exfiltration across enterprise SD-WAN deployments. Cisco SD-WAN is widely deployed in corporate networks to manage distributed branch connectivity and cloud access.
Mandiant's attribution remains incomplete. The firm has not publicly linked the activity to a known threat group or nation-state sponsor. The two-month pre-disclosure exploitation period suggests either sophisticated reconnaissance or prior knowledge of the vulnerability through independent discovery or supply chain access.
- 01Enterprises using Cisco Catalyst SD-WAN face potential compromise if unpatched since April 2026.
- 02Threat actors demonstrated capability to exploit SD-WAN infrastructure before vendor awareness.
- 03Network defenders must audit local access logs for anomalous privilege escalation activity.
Boston Scientific confirms cyberattack disrupting medical device shipments
The Massachusetts-based medical device manufacturer disclosed the incident in SEC filings Tuesday, warning of operational impact to its supply chain.
US sanctions Iranian nationals after UK power plant intrusion
Treasury action follows disclosure of cyber operation targeting British energy facility, marking coordinated transatlantic response to infrastructure threats.
Supply-chain attack embeds proxy botnet in Android car head units
Legitimate device-update app compromised to spread malware that turns in-vehicle systems into proxy nodes and ad-fraud platforms.