Yet another vulnerability has been unearthed in Cisco’s Catalyst SD-WAN Manager, with this latest issue potentially allowing attackers to run commands with full administrative privileges.

Tracked as CVE-2026-20245, the flaw affects Cisco Catalyst SD-WAN Manager across all deployment types, including on-premises, cloud-hosted, Cisco-managed, and even the FedRAMP government variant.

The networking giant said vulnerability stems from “insufficient validation of user-supplied input” in the product's command-line interface (CLI). An authenticated attacker holding netadmin privileges could upload a crafted file to exploit this weakness, triggering command injection that elevates their access to root control over the system.

While that authentication requirement raises the bar, the flaw can be unlocked by chaining it with two earlier vulnerabilities.

The company has also acknowledged limited observed exploitation in the wild, with at least some incidents resulting in unauthorized configuration changes being pushed to edge devices across affected deployments.

No patches are available yet and the company says there are no workarounds. Cisco said a fix is planned for a future release, though without providing a timeline.

Cisco is urging customers to check for indicators of compromise by auditing the scripts.log file at /var/log/ and to run the request admin-tech command from each SD-WAN control component before applying any updates, preserving log evidence that could help determine whether a breach has already occurred.

This latest Catalyst SD-WAN Manager flaw can be chained with two separate vulnerabilities – CVE-2026-20182 and CVE-2026-20127. Both allowed for remote unauthenticated attackers to gain administrative privileges by sending specially crafted requests that bypass authentication and login controls.

Cisco's Talos security research unit had linked both the earlier issues to UAT-8616, a “highly sophisticated” threat actor group with evidence dating their malicious activity as far back as 2023.