Cisco warns of unpatched SD-WAN zero-day exploited in attacks

A critical zero-day vulnerability in Cisco's Catalyst SD-WAN Manager, identified as CVE-2026-20245, is being actively exploited by attackers to gain root privileges¹. This high-severity flaw allows for privilege escalation, enabling malicious actors to take control of affected systems. The vulnerability is currently unpatched, and Cisco has issued a warning to alert users of the potential danger. The exploitation of this vulnerability can have severe consequences, including complete system compromise. As a result, users of the Cisco Catalyst SD-WAN Manager are advised to take immediate action to mitigate the risk. The fact that this vulnerability is being actively exploited in attacks makes it a pressing concern for organizations using the affected software. This matters to security practitioners because an unpatched zero-day vulnerability in a widely used product like Cisco's SD-WAN Manager poses a significant risk to network security, emphasizing the need for prompt attention and mitigation.