#1
BleepingComputer
general
June 24, 2026 at 21:29 UTC
Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access
By Lawrence Abrams
AI Summary
Mandiant revealed exploitation details for CVE-2026-20245, a zero-day vulnerability in Cisco Catalyst SD-WAN that attackers used to create rogue root accounts on targeted devices at a communications service provider — two months before the flaw was publicly disclosed. The attack leveraged rogue peering to connect to victim SD-WAN devices and escalate to admin and root-level privileges, representing a high-impact supply chain risk for telecom operators running Cisco SD-WAN infrastructure.
Relevance score: 88.0/100
Sponsored
Protect Your Business
Expert cybersecurity solutions to safeguard your organization from evolving threats.
Get Protected →