Cisco Catalyst SD-WAN Manager — CVE-2026-20245

CVE-2026-20245 (CVSS 7.8) is an improper-input-validation / command-injection flaw in the CLI of Cisco Catalyst SD-WAN Manager (formerly vManage). An attacker holding netadmin credentials can upload a crafted file (e.g., a tenant-list or serial-number CSV) that is processed by privileged helper scripts such as /usr/bin/vconfd_script_upload_tenant_list.sh; those scripts fail to escape input, so embedded shell commands execute as root. Cisco PSIRT confirmed active exploitation in limited cases, including incidents where configuration changes were pushed to edge devices. CISA added it to the KEV catalog on 9 June 2026. As of this pack there is no patch — only mitigations.

The Manager is the brain of the SD-WAN fabric: root on it means the attacker can rewrite routing/segmentation policy and push malicious templates to every managed edge router. All deployment types are affected — on-prem, Cisco SD-WAN Cloud-Pro, Cisco-managed cloud, and the FedRAMP/government edition. Activity is tentatively clustered as UAT-8616, based on prior targeting of related Cisco SD-WAN bugs, implying a well-resourced (possibly state-aligned) operator.

The highest-value defensive angle is the exploitation artifact Cisco itself calls out: suspicious vconfd_script_upload_* invocations in /var/log/scripts.log with shell metacharacters in their arguments. Because SD-WAN Manager is an appliance that rarely carries a Falcon sensor, the durable detection path is to forward scripts.log and the Manager audit log to NGSIEM and hunt there, paired with strict access control on the management plane.

Defender priority: Restrict management-plane access to SD-WAN Manager to a trusted admin bastion now, forward /var/log/scripts.log to NGSIEM, and alert on any vconfd_script_upload_* entry containing shell metacharacters (; | $( ` &&) — that is the exploitation fingerprint.

No public atomic IOCs (attacker IPs/hashes) were released as of 14 Jun 2026 — the campaign is described as limited/targeted. Detection here is behavioral and log-based, centered on the vconfd upload-script abuse signature and unauthorized config pushes.

Hunt hypotheses (fidelity-ordered)

1. H1 (high): /var/log/scripts.log shows a vconfd_script_upload_* invocation whose argument contains shell metacharacters — the injection signature. T1190 / T1068 / T1059
2. H2 (high): A crafted file (tenant list / vsmart serial / chassis number) was uploaded via the Manager CLI shortly before anomalous root command execution. T1059
3. H3 (high): An unauthorized SD-WAN configuration/template push to edge devices occurred outside change control. T1565 / T1505
4. H4 (medium-high): A netadmin session originated from an unusual source (new IP/ASN/geo) or outside maintenance windows, preceding upload activity. T1078
5. H5 (medium): The Manager appliance spawned an unexpected interactive shell, opened a new listener, or made anomalous outbound connections — post-exploitation foothold. T1059.004 / T1571
6. H6 (medium): Tampering with Manager logging/defenses or new persistence (cron, account) on the appliance. T1562 / T1053

Attack chain

⚠ Telemetry reality: The CQL in §8 assumes SD-WAN Manager logs are ingested into NGSIEM/LogScale (a custom repo). Field names depend on your parser — validate against your ingest before relying on them. Where a Falcon sensor is present on a related host, the process-based variants apply directly.

• On the Manager appliance (Cisco-recommended): inspect /var/log/scripts.log for vconfd_script_upload_* entries, especially any with shell metacharacters or non-standard / maliciously named CSV references.
• Manager audit log: review file-upload events and template/config-push actions; correlate each push to an approved change ticket. Flag any push with no corresponding change record.
• Edge device config diff: compare running config / applied templates on managed routers against the last known-good baseline for unexpected segmentation or routing changes.
• netadmin session review: list recent netadmin logons to the Manager — source IP/geo, time-of-day, and session duration; flag logins from new sources or outside maintenance windows.
• Appliance integrity: check for new local accounts, cron entries, modified /usr/bin/vconfd_script_upload_*.sh, and gaps/clears in scripts.log and syslog.

Because the Manager is usually sensor-less, the primary alerts here are NGSIEM scheduled searches over ingested appliance logs (Q2, Q3), not endpoint Custom IOAs. Q5 becomes an IOA only where a Falcon Linux sensor covers the host.

1 — Inspect scripts.log on the Manager for the injection signature

#!/usr/bin/env bash
# Run on the SD-WAN Manager (or over forwarded logs). Flags vconfd uploads
# whose lines contain shell metacharacters.
LOG=/var/log/scripts.log
grep -E 'vconfd_script_upload_[a-z_]+\.sh' "$LOG" \
  | grep -E '[;`|]|\$\(|&&|\bnc\b|\bbash\b|\bcurl\b|\bwget\b' \
  | tee /tmp/vconfd_injection_hits.txt
echo "[*] $(wc -l < /tmp/vconfd_injection_hits.txt) suspicious line(s)"

2 — NGSIEM scheduled-search alert (LogScale syntax) for Q2

# Schedule this as a recurring search; severity Critical, notify SOC.
#repo=sdwan_manager
| @rawstring=/vconfd_script_upload_\w+\.sh/
| @rawstring=/[;`|]|\$\(|&&|\|\||\bnc\b|\bbash\b|\bcurl\b|\bwget\b/

3 — Restrict management access (edge ACL fronting the Manager)

# Example: only the admin bastion subnet may reach the Manager admin UI/SSH.
ip access-list extended SDWAN-MGR-ACCESS
 permit ip 10.10.10.0 0.0.0.255 host <SDWAN_MANAGER_IP>
 deny   ip any host <SDWAN_MANAGER_IP> log
# Apply inbound on the interface facing the management network.

Known gaps: the dominant gap is telemetry on the appliance itself — SD-WAN Manager usually has no Falcon sensor, so Q5 only works where one is present and all other coverage depends on forwarding scripts.log + audit log to NGSIEM (§12 Immediate). No atomic IOCs are published, so the IOC CSV uses placeholders. Validate parser field names before promoting any query to alert.