From Unauthenticated Access to Root: Analyzing Cisco SD-WAN VulnerabilitiesCVE-2026-20182 and CVE-2026-20245
1. OVERVIEW:
Cisco Catalyst SD-WAN Controllers are affected by two vulnerabilities that can be chained together to achieve full system compromise. The first vulnerability, CVE-2026-20182, exists within the controller's peering authentication mechanism. By sending crafted requests to an affected system, an unauthenticated remote attacker can authenticate as an internal, high-privileged, non-root user account. This access provides the attacker with NETCONF capabilities, allowing them to manipulate SD-WAN network configurations and gain a foothold within the management infrastructure.
Once authenticated, the attacker can exploit CVE-2026-20245, a command injection vulnerability in the controller's CLI caused by insufficient validation of user-supplied input. By supplying a crafted file to the affected system, the attacker can execute arbitrary commands with root privileges. When chained together, these vulnerabilities allow an unauthenticated attacker to progress from initial access to full root-level control of a Cisco Catalyst SD-WAN Controller, potentially compromising the confidentiality, integrity, and availability of the SD-WAN environment.
Key Takeaways
Two Cisco SD-WAN vulnerabilities can be chained together to achieve root-level access.
CVE-2026-20182 allows an unauthenticated attacker to gain a high-privileged, non-root account.
Access to NETCONF enables attackers to modify SD-WAN configurations.
CVE-2026-20245 allows authenticated attackers to execute arbitrary commands as root.
Both vulnerabilities have been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog, indicating observed exploitation in the wild.
2. Data Flow Diagram:
3. STRIDE:
Category | Applicable | Justification |
Spoofing | Yes | Attacker authenticates as an internal high-privileged user. |
Tampering | Yes | Attacker can modify SD-WAN configurations via NETCONF. |
|
|
|
Repudiation | No Evidence | Not described in the advisory. |
Information Disclosure | No Evidence | Not directly described in the advisory. |
Denial of Service | No Evidence | Not directly described in the advisory. |
Elevation of Privilege | Yes | Attacker escalates from privileged user to root. |
4. DREAD:
DREAD Category | Low Risk (1) | Medium Risk (2) | High Risk (3) | Subtotal Risk Score |
Damage Potential (D) | ☐ | ☐ | ☑ | 3 |
Reproducibility (R) | ☐ | ☐ | ☑ | 3 |
Exploitability (E) | ☐ | ☐ | ☑ | 3 |
Affected Users (A) | ☐ | ☑ | ☐ | 2 |
Discoverability (D) | ☐ | ☐ | ☑ | 3 |
Total Risk Score | 14 / 15 |
DREAD Assessment Summary
Damage Potential (3): Successful exploitation of the vulnerability chain can result in full root-level compromise of a Cisco Catalyst SD-WAN Controller, enabling attackers to manipulate configurations, execute arbitrary commands, and potentially impact the confidentiality, integrity, and availability of the SD-WAN environment.
Reproducibility (3): The attack can be repeated against other vulnerable Cisco Catalyst SD-WAN deployments. Both vulnerabilities are publicly documented and have been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog.
Exploitability (3): An unauthenticated attacker can exploit CVE-2026-20182 to obtain a high-privileged, non-root account and then leverage CVE-2026-20245 to achieve root-level command execution, creating a practical and well-defined attack path.
Affected Users (2): The vulnerabilities affect organizations operating Cisco Catalyst SD-WAN Controllers. While the impact to affected environments can be severe, the attack surface is limited to organizations using the vulnerable platform.
Discoverability (3): Public Cisco advisories, CVE disclosures, and inclusion in the KEV Catalog make the vulnerabilities highly visible and discoverable to both defenders and threat actors.
Overall Risk Assessment: With a DREAD score of 14/15, this vulnerability chain presents a high-risk threat due to its ability to progress from unauthenticated access to full root compromise of critical SD-WAN management infrastructure.
5. Cyber Kill Chain:
Reconnaissance: Attackers identify networks hosting a Cisco Catalyst SD-WAN Controller and determine whether the controller is running a vulnerable version.
Weaponization: The attacker prepares crafted requests designed to exploit the vulnerable peering authentication mechanism and obtain access as a high-privileged, non-root user.
Delivery: The attacker delivers crafted requests to the SD-WAN Controller to exploit the peering authentication mechanism and later supplies a crafted file to the affected system to trigger command injection.
Exploitation: The attacker successfully exploits the peering authentication mechanism and gains access as a high-privileged, non-root user, providing access to NETCONF management capabilities.
Installation: The attacker uses NETCONF access to modify controller configurations and establish a foothold within the SD-WAN management environment.
Command & Control: The attacker leverages their privileged access to interact with and control the compromised SD-WAN Controller.
Actions on Objectives: The attacker exploits CVE-2026-20245 by supplying a crafted file, resulting in command injection and root-level command execution on the affected controller.
6. Diamond Model:
7. Cyber Shield Lens Assessment (CVSS Scoring & Mitre ATT&CK Word Mapping):
CVSS Assessment
Cyber Shield Lens assigned the Cisco Catalyst SD-WAN vulnerability chain a CVSS v3.1 score of 10.0 (Critical). This score reflects the ability of an unauthenticated attacker to remotely exploit CVE-2026-20182, gain access as a high-privileged non-root user, and subsequently leverage CVE-2026-20245 to achieve root-level command execution on the affected controller.
Metric | Value |
Attack Vector | Network |
Attack Complexity | Low |
Privileges Required | None |
User Interaction | None |
Scope | Changed |
Confidentiality | High |
Integrity | High |
Availability | High |
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: Critical (10.0)
MITRE ATT&CK Analysis
Cyber Shield Lens identified three primary MITRE ATT&CK tactics associated with this attack chain: Initial Access, Privilege Escalation, and Execution. The assessment identified the following techniques:
Initial Access
T1190 – Exploit Public-Facing Application
The attacker exploits a vulnerability exposed through the Cisco Catalyst SD-WAN Controller's management infrastructure. CVE-2026-20182 allows an unauthenticated attacker to authenticate as an internal, high-privileged, non-root user through the vulnerable peering authentication mechanism.
Privilege Escalation
T1068 – Exploitation for Privilege Escalation
After obtaining a privileged foothold, the attacker exploits CVE-2026-20245 to elevate privileges from a high-privileged non-root account to full root-level access on the controller.
Execution
T1059 – Command and Scripting Interpreter
Successful exploitation of CVE-2026-20245 results in arbitrary command execution as root through command injection, allowing the attacker to execute commands directly on the affected system.
Recommended Incident Response Actions
Initial Access
Organizations should investigate whether unauthorized access to SD-WAN management infrastructure has occurred.
Recommended Actions:
Review SD-WAN Controller authentication logs.
Identify suspicious access attempts targeting management interfaces.
Investigate unusual NETCONF session activity.
Review firewall, VPN, and network access logs.
Verify all affected systems are patched against CVE-2026-20182.
Identify any newly created or unauthorized privileged accounts.
Privilege Escalation
Because the attack chain ultimately results in root-level access, organizations should determine whether privilege escalation has already occurred.
Recommended Actions:
Audit privileged and administrative account activity.
Review role assignments and permission changes.
Investigate NETCONF configuration modifications.
Verify administrator and root account activity logs.
Review controller configuration history for unauthorized changes.
Validate least-privilege controls across SD-WAN management systems.
Execution
Successful exploitation allows arbitrary command execution on the controller and should be treated as a potential full-system compromise.
Recommended Actions:
Review command execution and process creation logs.
Investigate suspicious CLI activity.
Analyze system logs for command injection indicators.
Inspect endpoint detection and monitoring alerts.
Preserve forensic evidence for further investigation.
Isolate affected controllers if malicious activity is confirmed.
Conduct a full integrity review of controller configurations and managed devices.
Analyst Observation
While Cyber Shield Lens identified the attack chain as involving Initial Access, Privilege Escalation, and Execution, further analysis revealed a clear progression from unauthenticated access to a high-privileged non-root account through CVE-2026-20182, followed by root-level command execution through CVE-2026-20245. This combination creates a complete attack path capable of compromising the confidentiality, integrity, and availability of Cisco Catalyst SD-WAN management infrastructure.
8. Conclusion:
The Cisco Catalyst SD-WAN vulnerability chain demonstrates how attackers can progress from unauthenticated access to full root-level compromise by combining CVE-2026-20182 and CVE-2026-20245. Through authentication bypass, privileged access, NETCONF configuration manipulation, and ultimately command injection, an attacker can gain complete control of an affected controller. With both vulnerabilities added to CISA's Known Exploited Vulnerabilities (KEV) Catalog and Cyber Shield Lens assigning a CVSS score of 10.0 (Critical), organizations should prioritize patching, review management infrastructure for signs of compromise, and closely monitor privileged activity within their SD-WAN environments.
9. References:
CISA Known Exploited Vulnerabilities (KEV) Catalog – CVE-2026-20245
Cisco Security Advisory – CVE-2026-20245: Cisco Catalyst SD-WAN Manager Command Injection Vulnerability
The Open Group – The Open FAIR™ Risk Analysis Standard (DREAD Reference)
Cyber Shield Lens Assessment Report (Generated June 9, 2026). CVSS Assessment, MITRE ATT&CK Mapping, and Recommended Response Actions.
Comments