CVE-2026-20245 - Vulnerability Details

- Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability

Description

A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.

This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user.
To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices.
Cisco recommends that customers upgrade to the fixed software that is documented in the that was published on May 14, 2026, and verify the configuration of the edge devices.

Published: 2026-06-04

Score: 7.8 High

EPSS: 25.3% Moderate

KEV: Yes

Impact:

Action:

Analysis

Impact

The vulnerability is caused by insufficient validation of user‑supplied input in the command‑line interface of Cisco Catalyst SD‑WAN products, a weakness identified as CWE‑116. An attacker who has local netadmin credentials can upload a specially crafted file, allowing arbitrary command execution with root privileges. This privilege escalation can be used to alter the device connected edge devices, jeopardizing confidentiality, integrity, and availability.

Affected Systems

Affected components are Cisco Catalyst SD‑WAN Controller (formerly vSmart), Cisco Catalyst SD‑WAN Manager (formerly vManage), and Cisco Catalyst SD‑WAN Validator (formerly vBond). The advisory cites the 20.12.7 release as vulnerable, as referenced by the CPE identifiers, and no other versions are confirmed.

Risk and Exploitability

The advisory assigns a CVSS score of 7.8, indicating high severity, and an EPSS score of 25%. The vulnerability is listed in the CISA KEV catalog. Exploitation requires authenticated, local netadmin access; no remote attack vectors or other methods have been reported. Without valid netadmin credentials, the risk to a system is low, but if an attacker gains such access …

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Cisco

Cisco Catalyst SD-WAN Controller

unknown

Version	Status	Constraints
`20.6.4`	affected	—
`20.9.2`	affected	—
`20.3.6`	affected	—
`20.7.2`	affected	—
`20.7.1`	affected	—
`20.5.1`	affected	—
`20.6.2`	affected	—
`19.3.0`	affected	—
`20.6.1`	affected	—
`17.2.4`	affected	—
`18.2.0`	affected	—
`18.4.6`	affected	—
`19.1.0`	affected	—
`19.2.4`	affected	—
`19.2.929`	affected	—
`18.3.8`	affected	—
`18.4.303`	affected	—
`18.3.7`	affected	—
`18.4.1`	affected	—
`19.2.097`	affected	—
`19.2.0`	affected	—
`19.2.099`	affected	—
`18.3.6`	affected	—
`20.4.2`	affected	—
`19.0.0`	affected	—
`20.9.1`	affected	—
`20.3.5`	affected	—
`20.3.1`	affected	—
`18.3.5`	affected	—
`20.6.3`	affected	—
`18.4.3`	affected	—
`18.4.4`	affected	—
`18.3.3`	affected	—
`17.2.8`	affected	—
`20.8.1`	affected	—
`19.2.32`	affected	—
`19.2.2`	affected	—
`17.2.5`	affected	—
`18.4.0`	affected	—
`20.4.1.1`	affected	—
`20.1.3`	affected	—
`20.1.2`	affected	—
`17.2.10`	affected	—
`19.2.098`	affected	—
`20.1.1`	affected	—
`17.2.6`	affected	—
`19.2.1`	affected	—
`18.3.4`	affected	—
`20.4.1`	affected	—
`17.2.9`	affected	—
`19.2.31`	affected	—
`19.0.1a`	affected	—
`18.3.0`	affected	—
`17.2.7`	affected	—
`18.4.5`	affected	—
`20.3.4`	affected	—
`20.3.3`	affected	—
`20.4.1.2`	affected	—
`20.3.2`	affected	—
`18.3.1`	affected	—
`20.1.12`	affected	—
`19.2.3`	affected	—
`20.10.1`	affected	—
`20.6.5`	affected	—
`20.3.7`	affected	—
`20.9.3`	affected	—
`20.11.1`	affected	—
`20.6.3.2`	affected	—
`20.4.2.3`	affected	—
`20.3.5.1`	affected	—
`20.3.4.3`	affected	—
`20.9.3.1`	affected	—
`20.6.4.1`	affected	—
`20.3.3.2`	affected	—
`20.6.5.2`	affected	—
`20.3.7.1`	affected	—
`20.11.1.1`	affected	—
`20.10.1.1`	affected	—
`20.6.1.2`	affected	—
`20.1.3.1`	affected	—
`20.9.2.2`	affected	—
`20.6.5.3`	affected	—
`20.6.3.3`	affected	—
`20.3.7.2`	affected	—
`20.6.5.4`	affected	—
`20.9.2.3`	affected	—
`20.9.4`	affected	—
`20.12.1`	affected	—
`20.3.8`	affected	—
`20.6.6`	affected	—
`20.12.2`	affected	—
`20.13.1`	affected	—
`20.9.5`	affected	—
`20.12.3`	affected	—
`20.6.7`	affected	—
`20.9.5.1`	affected	—
`20.14.1`	affected	—
`20.12.3.1`	affected	—
`20.12.4`	affected	—
`20.15.1`	affected	—
`20.9.6`	affected	—
`20.6.8`	affected	—
`20.16.1`	affected	—
`20.9.5.3`	affected	—
`20.12.4.1`	affected	—
`20.15.2`	affected	—
`20.12.5`	affected	—
`20.9.7`	affected	—
`20.15.3`	affected	—
`20.12.5.1`	affected	—
`20.12.5.2`	affected	—
`20.15.4`	affected	—
`20.9.7.1`	affected	—
`20.18.1`	affected	—
`20.12.6`	affected	—
`20.9.8`	affected	—
`20.15.4.1`	affected	—
`20.18.2`	affected	—
`26.1.1`	affected	—
`20.15.4.2`	affected	—
`20.18.2.1`	affected	—
`20.12.5.3`	affected	—
`20.12.6.1`	affected	—
`20.9.8.2`	affected	—
`20.15.5`	affected	—
`20.18.3`	affected	—
`20.12.7`	affected	—
`20.9.9`	affected	—
`20.18.2.2`	affected	—
`20.12.5.4`	affected	—
`20.12.7.1`	affected	—
`20.15.5.1`	affected	—
`20.15.4.3`	affected	—
`20.12.6.2`	affected	—
`20.15.5.2`	affected	—
`20.15.4.4`	affected	—
`26.1.1.1`	affected	—
`20.9.9.1`	affected	—
`26.1.1.2`	affected	—
`20.15.4.5`	affected	—
`20.15.5.3`	affected	—

Cisco

Cisco Catalyst SD-WAN Manager

unknown

Version	Status	Constraints
`20.1.12`	affected	—
`19.2.1`	affected	—
`18.4.4`	affected	—
`18.4.5`	affected	—
`20.1.1.1`	affected	—
`20.1.1`	affected	—
`19.3.0`	affected	—
`19.2.2`	affected	—
`19.2.099`	affected	—
`18.3.6`	affected	—
`18.3.7`	affected	—
`19.2.0`	affected	—
`18.3.8`	affected	—
`19.0.0`	affected	—
`19.1.0`	affected	—
`18.4.302`	affected	—
`18.4.303`	affected	—
`19.2.097`	affected	—
`19.2.098`	affected	—
`17.2.10`	affected	—
`18.3.6.1`	affected	—
`19.0.1a`	affected	—
`18.2.0`	affected	—
`18.4.3`	affected	—
`18.4.1`	affected	—
`17.2.8`	affected	—
`18.3.3.1`	affected	—
`18.4.0`	affected	—
`18.3.1`	affected	—
`17.2.6`	affected	—
`17.2.9`	affected	—
`18.3.4`	affected	—
`17.2.5`	affected	—
`18.3.1.1`	affected	—
`18.3.5`	affected	—
`18.4.0.1`	affected	—
`18.3.3`	affected	—
`17.2.7`	affected	—
`17.2.4`	affected	—
`18.3.0`	affected	—
`19.2.3`	affected	—
`18.4.501_ES`	affected	—
`20.3.1`	affected	—
`20.1.2`	affected	—
`19.2.929`	affected	—
`19.2.31`	affected	—
`20.3.2`	affected	—
`19.2.32`	affected	—
`20.3.2_925`	affected	—
`20.3.2.1`	affected	—
`20.3.2.1_927`	affected	—
`18.4.6`	affected	—
`20.1.2_937`	affected	—
`20.4.1`	affected	—
`20.3.2_928`	affected	—
`20.3.2_929`	affected	—
`20.4.1.0.1`	affected	—
`20.3.2.1_930`	affected	—
`19.2.4`	affected	—
`20.5.0.1.1`	affected	—
`20.4.1.1`	affected	—
`20.3.3`	affected	—
`19.2.4.0.1`	affected	—
`20.3.2_937`	affected	—
`20.3.3.1`	affected	—
`20.5.1`	affected	—
`20.1.3`	affected	—
`20.3.3.0.4`	affected	—
`20.3.3.1.2`	affected	—
`20.3.3.1.1`	affected	—
`20.4.1.2`	affected	—
`20.3.3.0.2`	affected	—
`20.4.1.1.5`	affected	—
`20.4.1.0.01`	affected	—
`20.4.1.0.02`	affected	—
`20.3.3.1.7`	affected	—
`20.3.3.1.5`	affected	—
`20.5.1.0.1`	affected	—
`20.3.3.1.10`	affected	—
`20.3.3.0.8`	affected	—
`20.4.2`	affected	—
`20.4.2.0.1`	affected	—
`20.3.4`	affected	—
`20.3.3.0.14`	affected	—
`19.2.4.0.8`	affected	—
`19.2.4.0.9`	affected	—
`20.3.4.0.1`	affected	—
`20.3.2.0.5`	affected	—
`20.6.1`	affected	—
`20.5.1.0.2`	affected	—
`20.3.3.0.17`	affected	—
`20.6.1.1`	affected	—
`20.6.0.18.3`	affected	—
`20.3.2.0.6`	affected	—
`20.6.0.18.4`	affected	—
`20.4.2.0.2`	affected	—
`20.3.3.0.16`	affected	—
`20.3.4.0.5`	affected	—
`20.6.1.0.1`	affected	—
`20.3.4.0.6`	affected	—
`20.6.2`	affected	—
`20.7.1EFT2`	affected	—
`20.3.4.0.9`	affected	—
`20.3.4.0.11`	affected	—
`20.4.2.0.4`	affected	—
`20.3.3.0.18`	affected	—
`20.7.1`	affected	—
`20.6.2.1`	affected	—
`20.3.4.1`	affected	—
`20.5.1.1`	affected	—
`20.4.2.1`	affected	—
`20.4.2.1.1`	affected	—
`20.3.4.1.1`	affected	—
`20.3.813`	affected	—
`20.3.4.0.19`	affected	—
`20.4.2.2.1`	affected	—
`20.5.1.2`	affected	—
`20.3.4.2`	affected	—
`20.3.814`	affected	—
`20.4.2.2`	affected	—
`20.6.2.2`	affected	—
`20.3.4.2.1`	affected	—
`20.7.1.1`	affected	—
`20.3.4.1.2`	affected	—
`20.6.2.2.2`	affected	—
`20.3.4.0.20`	affected	—
`20.6.2.2.3`	affected	—
`20.4.2.2.2`	affected	—
`20.3.5`	affected	—
`20.6.2.0.4`	affected	—
`20.4.2.2.3`	affected	—
`20.3.4.0.24`	affected	—
`20.6.2.2.7`	affected	—
`20.6.3`	affected	—
`20.3.4.2.2`	affected	—
`20.4.2.2.4`	affected	—
`20.7.1.0.2`	affected	—
`20.8.1`	affected	—
`20.3.5.0.8`	affected	—
`20.3.5.0.9`	affected	—
`20.4.2.2.8`	affected	—
`20.3.5.0.7`	affected	—
`20.6.3.0.7`	affected	—
`20.6.3.0.5`	affected	—
`20.6.3.0.10`	affected	—
`20.6.3.0.2`	affected	—
`20.7.2`	affected	—
`20.9.1EFT2`	affected	—
`20.6.3.0.11`	affected	—
`20.6.3.1`	affected	—
`20.6.3.0.14`	affected	—
`20.6.4`	affected	—
`20.9.1`	affected	—
`20.6.3.0.19`	affected	—
`20.6.3.0.18`	affected	—
`20.3.6`	affected	—
`20.9.1.1`	affected	—
`20.6.3.0.23`	affected	—
`20.6.4.0.4`	affected	—
`20.6.3.0.25`	affected	—
`20.6.5`	affected	—
`20.6.3.0.27`	affected	—
`20.9.2`	affected	—
`20.9.2.1`	affected	—
`20.6.3.0.29`	affected	—
`20.6.3.0.31`	affected	—
`20.6.3.0.32`	affected	—
`20.10.1`	affected	—
`20.6.3.0.33`	affected	—
`20.9.2.0.01`	affected	—
`20.9.1_LI_Images`	affected	—
`20.10.1_LI_Images`	affected	—
`20.9.2_LI_Images`	affected	—
`20.3.7`	affected	—
`20.9.3`	affected	—
`20.6.5.1`	affected	—
`20.11.1`	affected	—
`20.11.1_LI_Images`	affected	—
`20.9.3_LI_ Images`	affected	—
`20.6.3.1.1`	affected	—
`20.9.3.0.2`	affected	—
`20.6.5.1.2`	affected	—
`20.9.3.0.3`	affected	—
`20.4.2.3`	affected	—
`20.6.3.2`	affected	—
`20.6.4.1`	affected	—
`20.6.3.0.38`	affected	—
`20.6.3.0.39`	affected	—
`20.3.5.1`	affected	—
`20.3.4.3`	affected	—
`20.9.3.1`	affected	—
`20.3.3.2`	affected	—
`20.6.5.2`	affected	—
`20.3.7.1`	affected	—
`20.10.1.1`	affected	—
`20.6.5.2.1`	affected	—
`20.3.4.0.25`	affected	—
`20.6.2.2.4`	affected	—
`20.6.1.2`	affected	—
`20.11.1.1`	affected	—
`20.9.3.0.5`	affected	—
`20.3.4.0.26`	affected	—
`20.6.5.1.3`	affected	—
`20.6.3.0.40`	affected	—
`20.1.3.1`	affected	—
`20.9.2.2`	affected	—
`20.6.5.2.3`	affected	—
`20.6.5.1.4`	affected	—
`20.6.5.3`	affected	—
`20.6.3.0.41`	affected	—
`20.9.3.0.7`	affected	—
`20.6.5.1.5`	affected	—
`20.9.3.0.4`	affected	—
`20.6.4.0.19`	affected	—
`20.6.5.1.6`	affected	—
`20.9.3.0.8`	affected	—
`20.6.3.3`	affected	—
`20.3.7.2`	affected	—
`20.6.5.4`	affected	—
`20.6.5.1.7`	affected	—
`20.9.3.0.12`	affected	—
`20.6.4.2`	affected	—
`20.6.5.5`	affected	—
`20.9.3.2`	affected	—
`20.11.1.2`	affected	—
`20.6.3.4`	affected	—
`20.10.1.2`	affected	—
`20.6.5.1.9`	affected	—
`20.9.3.0.16`	affected	—
`20.6.3.0.45`	affected	—
`20.6.5.1.10`	affected	—
`20.9.3.0.17`	affected	—
`20.6.5.2.4`	affected	—
`20.6.4.0.21`	affected	—
`20.9.3.0.18`	affected	—
`20.6.3.0.46`	affected	—
`20.6.3.0.47`	affected	—
`20.9.2.3`	affected	—
`20.9.3.2_LI_Images`	affected	—
`20.9.3.0.21`	affected	—
`20.9.3.0.20`	affected	—
`20.9.4_LI_Images`	affected	—
`20.9.4`	affected	—
`20.6.5.1.11`	affected	—
`20.12.1`	affected	—
`20.12.1_LI_Images`	affected	—
`20.6.5.1.13`	affected	—
`20.9.3.0.23`	affected	—
`20.6.5.2.8`	affected	—
`20.9.4.1`	affected	—
`20.9.4.1_LI_Images`	affected	—
`20.9.3.0.25`	affected	—
`20.9.3.0.24`	affected	—
`20.6.5.1.14`	affected	—
`20.3.8`	affected	—
`20.6.6`	affected	—
`20.9.3.0.26`	affected	—
`20.6.3.0.51`	affected	—
`20.9.3.0.29`	affected	—
`20.12.2`	affected	—
`20.12.2_LI_Images`	affected	—
`20.6.6.0.1`	affected	—
`20.13.1_LI_Images`	affected	—
`20.9.4.0.4`	affected	—
`20.13.1`	affected	—
`20.9.4.1.1`	affected	—
`20.9.5`	affected	—
`20.9.5_LI_Images`	affected	—
`20.12.3_LI_Images`	affected	—
`20.12.3`	affected	—
`20.9.4.1.3`	affected	—
`20.6.7`	affected	—
`20.9.5.1`	affected	—
`20.9.5.1_LI_Images`	affected	—
`20.9.4.1.6`	affected	—
`20.14.1`	affected	—
`20.14.1_LI_Images`	affected	—
`20.9.5.2`	affected	—
`20.9.5.2.1`	affected	—
`20.9.5.2_LI_Images`	affected	—
`20.12.3.1`	affected	—
`20.12.4`	affected	—
`20.15.1_LI_Images`	affected	—
`20.15.1`	affected	—
`20.9.5.1.4`	affected	—
`20.9.5.2.7`	affected	—
`20.9.5.2.13`	affected	—
`20.9.6`	affected	—
`20.9.6_LI_Images`	affected	—
`20.9.5.2.14`	affected	—
`20.6.8`	affected	—
`20.12.4.0.03`	affected	—
`20.16.1`	affected	—
`20.16.1_LI_Images`	affected	—
`20.12.4_LI_Images`	affected	—
`20.9.5.2.16`	affected	—
`20.12.4.0.4`	affected	—
`20.12.401`	affected	—
`20.9.5.3`	affected	—
`20.9.5.3_LI_Images`	affected	—
`20.12.4.1_LI_Images`	affected	—
`20.12.4.1`	affected	—
`20.9.5.2.21`	affected	—
`20.9.6.0.3`	affected	—
`20.12.4.0.6`	affected	—
`20.15.2_LI_Images`	affected	—
`20.15.2`	affected	—
`20.12.4_Monthly_ES5`	affected	—
`20.12.5`	affected	—
`20.12.5_LI_Images`	affected	—
`20.9.7_LI _Images`	affected	—
`20.9.7`	affected	—
`20.15.3`	affected	—
`20.15.3_ LI _Images`	affected	—
`20.12.501`	affected	—
`20.12.5.1_LI_Images`	affected	—
`20.12.5.1`	affected	—
`20.12.5.2_LI_Images`	affected	—
`20.12.5.2`	affected	—
`20.15.3.1`	affected	—
`20.15.4_LI_Images`	affected	—
`20.15.4`	affected	—
`20.9.7.1_LI _Images`	affected	—
`20.9.7.1`	affected	—
`20.18.1`	affected	—
`20.18.1_LI_Images`	affected	—
`20.12.6_LI_Images`	affected	—
`20.12.6`	affected	—
`20.12.5.1.01`	affected	—
`26.0.1`	affected	—
`20.9.8`	affected	—
`20.9.8_LI_Images`	affected	—
`20.18.2`	affected	—
`20.15.4.1_LI_Images`	affected	—
`20.15.4.1`	affected	—
`20.18.2_LI_Images`	affected	—
`26.1.1`	affected	—
`26.1.1_LI_Images`	affected	—
`20.18.2.1_LI_Images`	affected	—
`20.18.2.1`	affected	—
`20.15.4.2_LI_Images`	affected	—
`20.15.4.2`	affected	—
`20.12.6.1`	affected	—
`20.12.6.1_LI_Images`	affected	—
`20.12.5.3`	affected	—
`20.12.5.3_LI_Images`	affected	—
`20.9.8.2_LI_Images`	affected	—
`20.9.8.2`	affected	—
`20.18.3`	affected	—
`20.18.3_LI_Images`	affected	—
`20.15.5`	affected	—
`20.15.5_LI_Images`	affected	—
`20.12.7`	affected	—
`20.12.7_LI_Images`	affected	—
`20.9.9`	affected	—
`20.9.9_LI_Images`	affected	—
`20.18.2.2`	affected	—
`20.18.2.2_LI_Images`	affected	—
`20.12.5.4`	affected	—
`20.12.5.4_LI_ Images`	affected	—
`20.12.7.1_LI_Images`	affected	—
`20.12.6.2_LI_Images`	affected	—
`20.12.7.1`	affected	—
`20.15.5.1`	affected	—
`20.15.4.3`	affected	—
`20.15.4.3_LI_Images`	affected	—
`20.15.5.1_LI_Images`	affected	—
`20.12.6.2`	affected	—
`20.15.5.2`	affected	—
`20.15.5.2_LI_Images`	affected	—
`26.1.1.1_LI_Images`	affected	—
`20.15.4.4`	affected	—
`20.15.4.4_LI_Images`	affected	—
`26.1.1.1`	affected	—
`20.9.9.1_LI_Images`	affected	—
`20.9.9.1`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:cisco:catalyst_sd-wan_manager::::::::
	cpe:2.3:a:cisco:catalyst_sd-wan_manager::::::::
	cpe:2.3:a:cisco:catalyst_sd-wan_manager::::::::
	cpe:2.3:a:cisco:catalyst_sd-wan_manager::::::::
	cpe:2.3:a:cisco:catalyst_sd-wan_manager::::::::
	cpe:2.3:a:cisco:catalyst_sd-wan_manager::::::::
	cpe:2.3:a:cisco:catalyst_sd-wan_manager::::::::
	cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.7:::::::*
	cpe:2.3:a:cisco:sd-wan_vsmart_controller::::::::
	cpe:2.3:a:cisco:sd-wan_vsmart_controller::::::::
	cpe:2.3:a:cisco:sd-wan_vsmart_controller::::::::
	cpe:2.3:a:cisco:sd-wan_vsmart_controller::::::::
	cpe:2.3:a:cisco:sd-wan_vsmart_controller::::::::
	cpe:2.3:a:cisco:sd-wan_vsmart_controller::::::::
	cpe:2.3:a:cisco:sd-wan_vsmart_controller::::::::
	cpe:2.3:a:cisco:sd-wan_vsmart_controller:20.12.7:::::::*

No data.

Vendor Product Confidence Versions

Cisco

Catalyst Sd-wan Manager

91%

Version	Status	Scheme	Platform
`20.1.12`	affected	semver	—
`19.2.1`	affected	semver	—
`18.4.4`	affected	semver	—
`18.4.5`	affected	semver	—
`20.1.1.1`	affected	semver	—
`20.1.1`	affected	semver	—
`19.3.0`	affected	semver	—
`19.2.2`	affected	semver	—
`19.2.099`	affected	semver	—
`18.3.6`	affected	semver	—
`18.3.7`	affected	semver	—
`19.2.0`	affected	semver	—
`18.3.8`	affected	semver	—
`19.0.0`	affected	semver	—
`19.1.0`	affected	semver	—
`18.4.302`	affected	generic	—
`18.4.303`	affected	generic	—
`19.2.097`	affected	semver	—
`19.2.098`	affected	semver	—
`17.2.10`	affected	semver	—
`18.3.6.1`	affected	generic	—
`19.0.1a`	affected	generic	—
`18.2.0`	affected	semver	—
`18.4.3`	affected	semver	—
`18.4.1`	affected	semver	—
`17.2.8`	affected	semver	—
`18.3.3.1`	affected	generic	—
`18.4.0`	affected	semver	—
`18.3.1`	affected	semver	—
`17.2.6`	affected	semver	—
`17.2.9`	affected	semver	—
`18.3.4`	affected	generic	—
`17.2.5`	affected	semver	—
`18.3.1.1`	affected	generic	—
`18.3.5`	affected	generic	—
`18.4.0.1`	affected	generic	—
`18.3.3`	affected	generic	—
`17.2.7`	affected	semver	—
`17.2.4`	affected	semver	—
`18.3.0`	affected	generic	—
`19.2.3`	affected	semver	—
`18.4.501_ES`	affected	generic	—
`20.3.1`	affected	semver	—
`20.1.2`	affected	semver	—
`19.2.929`	affected	semver	—
`19.2.31`	affected	semver	—
`20.3.2`	affected	semver	—
`19.2.32`	affected	generic	—
`20.3.2_925`	affected	semver	—
`20.3.2.1`	affected	generic	—
`20.3.2.1_927`	affected	generic	—
`18.4.6`	affected	semver	—
`20.1.2_937`	affected	semver	—
`20.4.1`	affected	semver	—
`20.3.2_928`	affected	generic	—
`20.3.2_929`	affected	generic	—
`20.4.1.0.1`	affected	semver	—
`20.3.2.1_930`	affected	generic	—
`19.2.4`	affected	generic	—
`20.5.0.1.1`	affected	semver	—
`20.4.1.1`	affected	semver	—
`20.3.3`	affected	generic	—
`19.2.4.0.1`	affected	generic	—
`20.3.2_937`	affected	generic	—
`20.3.3.1`	affected	generic	—
`20.5.1`	affected	generic	—
`20.1.3`	affected	semver	—
`20.3.3.0.4`	affected	generic	—
`20.3.3.1.2`	affected	generic	—
`20.3.3.1.1`	affected	generic	—
`20.4.1.2`	affected	semver	—
`20.3.3.0.2`	affected	generic	—
`20.4.1.1.5`	affected	semver	—
`20.4.1.0.01`	affected	generic	—
`20.4.1.0.02`	affected	generic	—
`20.3.3.1.7`	affected	generic	—
`20.3.3.1.5`	affected	generic	—
`20.5.1.0.1`	affected	generic	—
`20.3.3.1.10`	affected	generic	—
`20.3.3.0.8`	affected	generic	—
`20.4.2`	affected	generic	—
`20.4.2.0.1`	affected	generic	—
`20.3.4`	affected	semver	—
`20.3.3.0.14`	affected	generic	—
`19.2.4.0.8`	affected	generic	—
`19.2.4.0.9`	affected	generic	—
`20.3.4.0.1`	affected	semver	—
`20.3.2.0.5`	affected	generic	—
`20.6.1`	affected	semver	—
`20.5.1.0.2`	affected	semver	—
`20.3.3.0.17`	affected	generic	—
`20.6.1.1`	affected	semver	—
`20.6.0.18.3`	affected	generic	—
`20.3.2.0.6`	affected	generic	—
`20.6.0.18.4`	affected	semver	—
`20.4.2.0.2`	affected	semver	—
`20.3.3.0.16`	affected	generic	—
`20.3.4.0.5`	affected	generic	—
`20.6.1.0.1`	affected	generic	—
`20.3.4.0.6`	affected	semver	—
`20.6.2`	affected	semver	—
`20.7.1EFT2`	affected	semver	—
`20.3.4.0.9`	affected	generic	—
`20.3.4.0.11`	affected	generic	—
`20.4.2.0.4`	affected	generic	—
`20.3.3.0.18`	affected	generic	—
`20.7.1`	affected	semver	—
`20.6.2.1`	affected	semver	—
`20.3.4.1`	affected	generic	—
`20.5.1.1`	affected	semver	—
`20.4.2.1`	affected	semver	—
`20.4.2.1.1`	affected	generic	—
`20.3.4.1.1`	affected	generic	—
`20.3.813`	affected	generic	—
`20.3.4.0.19`	affected	generic	—
`20.4.2.2.1`	affected	semver	—
`20.5.1.2`	affected	semver	—
`20.3.4.2`	affected	generic	—
`20.3.814`	affected	generic	—
`20.4.2.2`	affected	generic	—
`20.6.2.2`	affected	generic	—
`20.3.4.2.1`	affected	semver	—
`20.7.1.1`	affected	semver	—
`20.3.4.1.2`	affected	generic	—
`20.6.2.2.2`	affected	generic	—
`20.3.4.0.20`	affected	generic	—
`20.6.2.2.3`	affected	generic	—
`20.4.2.2.2`	affected	generic	—
`20.3.5`	affected	generic	—
`20.6.2.0.4`	affected	generic	—
`20.4.2.2.3`	affected	generic	—
`20.3.4.0.24`	affected	generic	—
`20.6.2.2.7`	affected	generic	—
`20.6.3`	affected	generic	—
`20.3.4.2.2`	affected	generic	—
`20.4.2.2.4`	affected	generic	—
`20.7.1.0.2`	affected	generic	—
`20.8.1`	affected	generic	—
`20.3.5.0.8`	affected	generic	—
`20.3.5.0.9`	affected	generic	—
`20.4.2.2.8`	affected	generic	—
`20.3.5.0.7`	affected	generic	—
`20.6.3.0.7`	affected	generic	—
`20.6.3.0.5`	affected	generic	—
`20.6.3.0.10`	affected	generic	—
`20.6.3.0.2`	affected	generic	—
`20.7.2`	affected	generic	—
`20.9.1EFT2`	affected	generic	—
`20.6.3.0.11`	affected	generic	—
`20.6.3.1`	affected	generic	—
`20.6.3.0.14`	affected	generic	—
`20.6.4`	affected	generic	—
`20.9.1`	affected	generic	—
`20.6.3.0.19`	affected	generic	—
`20.6.3.0.18`	affected	generic	—
`20.3.6`	affected	generic	—
`20.9.1.1`	affected	generic	—
`20.6.3.0.23`	affected	generic	—
`20.6.4.0.4`	affected	generic	—
`20.6.3.0.25`	affected	generic	—
`20.6.5`	affected	generic	—
`20.6.3.0.27`	affected	generic	—
`20.9.2`	affected	generic	—
`20.9.2.1`	affected	generic	—
`20.6.3.0.29`	affected	generic	—
`20.6.3.0.31`	affected	generic	—
`20.6.3.0.32`	affected	generic	—
`20.10.1`	affected	generic	—
`20.6.3.0.33`	affected	generic	—
`20.9.2.0.01`	affected	generic	—
`20.9.1_LI_Images`	affected	generic	—
`20.10.1_LI_Images`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the fixed software update released on May 14 2026 as documented by Cisco’s Security Advisory.
Verify that edge device configurations have not been unintentionally altered and rollback any unauthorized changes.
Audit or restrict netadmin user privileges to limit local attack surface and consider removing unused accounts.
Monitor logs for unexpected file uploads or command execution attempts to detect potential exploitation attempts.

Generated by OpenCVE AI on July 31, 2026 at 17:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is in the KEV database since June 9, 2026.

The EPSS score is 0.25323.

Exploitation active

Automatable no

Technical Impact total

References

Link	Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20245

History

Tue, 21 Jul 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description	A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user.  To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices. Cisco recommends that customers upgrade to the fixed software that is documented in the that was published on May 14, 2026, and verify the configuration of the edge devices.	A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user. To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices. Cisco recommends that customers upgrade to the fixed software that is documented in the that was published on May 14, 2026, and verify the configuration of the edge devices.

Wed, 10 Jun 2026 13:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Cisco sd-wan Vsmart Controller
CPEs		cpe:2.3:a:cisco:catalyst_sd-wan_manager:::::::: cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.12.7:::::::* cpe:2.3:a:cisco:sd-wan_vsmart_controller:::::::: cpe:2.3:a:cisco:sd-wan_vsmart_controller:20.12.7:::::::*
Vendors & Products		Cisco sd-wan Vsmart Controller

Tue, 09 Jun 2026 21:45:00 +0000

Type	Values Removed	Values Added
Description	A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user. To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices. Cisco recommends that customers upgrade to the fixed software that is documented in the that was published on May 14, 2026, and verify the configuration of the edge devices.	A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user.  To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices. Cisco recommends that customers upgrade to the fixed software that is documented in the that was published on May 14, 2026, and verify the configuration of the edge devices.

Tue, 09 Jun 2026 20:30:00 +0000

Type	Values Removed	Values Added
References		https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20245
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 09 Jun 2026 18:45:00 +0000

Type	Values Removed	Values Added
Metrics		kev `{'dateAdded': '2026-06-09T00:00:00+00:00', 'dueDate': '2026-06-23T00:00:00+00:00'}`

Sun, 07 Jun 2026 11:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Cisco Cisco catalyst Sd-wan Manager
Vendors & Products		Cisco Cisco catalyst Sd-wan Manager

Fri, 05 Jun 2026 03:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 04 Jun 2026 22:45:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user. To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices. Cisco recommends that customers upgrade to the fixed software that is documented in the that was published on May 14, 2026, and verify the configuration of the edge devices.
Title		Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability
Weaknesses		CWE-116
References		https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Subscriptions

Cisco Catalyst Sd-wan Manager Sd-wan Vsmart Controller

MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2026-06-04T22:33:00.748Z

Updated: 2026-07-21T16:17:48.759Z

Reserved: 2025-10-08T11:59:15.400Z

Link: CVE-2026-20245

Vulnrichment

Updated: 2026-06-05T02:00:12.346Z

NVD

Status : Analyzed

Published: 2026-06-04T23:17:31.763

Modified: 2026-06-10T12:59:09.600

Link: CVE-2026-20245

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-07-31T17:45:04Z

Weaknesses

CWE-116
Improper Encoding or Escaping of Output

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation active

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object