Cisco SD-WAN Zero-Day Exploited: Root Access via CSV Upload
Quick answer
A zero-day in Cisco Catalyst SD-WAN Manager allowed root access via a malicious CSV upload. Learn how the attack unfolded and how to protect your network.
In early 2026, Mandiant spotted a threat actor slithering into a service provider’s SD-WAN infrastructure. After initial access, they exploited a zero-day (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager to escalate from admin to root—using a malicious CSV file. The attacker then meticulously cleaned their tracks, like a caiman slipping back into murky waters.
Key Observations
- Rogue Peering & Credential Manipulation: The actor established unauthorized peering connections to gain SSH access, then changed default admin passwords to avoid detection.
- Exploitation of CVE-2026-20245: A crafted CSV upload triggered privilege escalation to root, creating a backdoor user ‘troot’.
- Anti-Forensic Cleanup: Files were deleted, configurations restored, and a validation script ensured no traces remained.
What’s SD-WAN?
Traditional WANs rely on rigid hardware routers. SD-WAN decouples control from hardware, letting a central software controller orchestrate the network. It’s used by distributed orgs like banks and healthcare to connect branches to cloud services securely.
Peering Explained
Peering is the digital handshake between SD-WAN components—edge routers, hubs, controllers—using cryptographic certificates to establish trust and build secure tunnels.
Intrusion Breakdown
Initial Access via Rogue Peering
From late 2025 to Jan 2026, multiple unauthorized peering connections hit the victim’s SD-WAN Manager. Possibly exploiting CVE-2026-20127 or CVE-2026-20182 (critical auth bypass flaws). In March 2026, more rogue peering occurred, likely using stolen certificates from a prior compromise.
Password Change & Config Exfiltration
The actor SSH’d as vmanage-admin, changed the admin password, logged into the web UI, and exfiltrated fabric configs. They later reverted the password to avoid detection.
Privilege Escalation via CVE-2026-20245
Using the admin account, they ran request tenant-upload tenant-list /home/admin/evil_tenant.csv vpn 0. The CSV contained a payload that backed up system files, then appended a root user ‘troot’ to /etc/passwd and /etc/shadow. They then su‘d to ‘troot’ for full root access.
Anti-Forensics
The actor deleted all created files, restored modified configs, and ran a validation script to confirm no traces remained. This included checking for the ‘troot’ account and the backup files.
Outlook & Implications
This campaign highlights the ‘living off the edge’ trend—attackers targeting network appliances to bypass perimeters. SD-WAN orchestrators are prime targets: they’re black boxes with limited telemetry and provide wide access. Zero-days in these platforms are gold for state-sponsored actors.
Remediation Steps
- Threat Hunt: Collect logs via
request admin-techand scan for IOCs. - Patch Now: Upgrade to fixed versions: 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, 26.1.1.2 or later.
- Harden: Follow Cisco’s SD-WAN Hardening Guide.
- Contact TAC: Report suspicious activity to Cisco TAC.
Indicators of Compromise
Network IOCs
- 126.51.108[.]152 (rogue device, exploited CVE-2026-20245)
- 76.92.245[.]217
- 207.190.37[.]94
- 23.245.7[.]178
- 153.186.231[.]233
- 167.179.79[.]189
- 45.32.38[.]160
- 209.137.225[.]101
File IOC
/home/admin/evil_tenant.csv(SHA256: b82936f37648518425c7d3cf9e09eaffa41d7cdb3840f6a40287e3a108880f7b)
Detection & Hunting
Monitor for:
- SSH from unexpected IPs as
vmanage-admin - Rapid password changes on
adminaccount suto ‘troot’ from admin- Execution of
vconfd_script_upload_tenant_list.shwith suspicious CSV files
Google SecOps customers have rules like ‘Privileged Account Append to Passwd Database’ to detect this activity.
Original announcement published on Google Cloud.