Cisco Catalyst SD-WAN Products Authenticated Privilege Escalation Vulnerability (CVE-2026-20245) (sec.cloudapps.cisco.com)

• Authenticated local attacker with netadmin privileges can execute commands as root
• Command injection via insufficient input validation
• Limited exploitation observed; Cisco urges upgrade and log auditing

"Cisco disclosed a vulnerability (CVE-2026-20245) in Catalyst SD-WAN Controller, Manager, and Validator allowing authenticated local attackers with netadmin privileges to execute arbitrary commands as root via crafted file upload. Exploitation requires prior compromise of prerequisites CVE-2026-20182 or CVE-2026-20127. Cisco observed limited exploitation leading to configuration changes on edge devices. Fixed software versions are available; no workarounds."