Network infrastructure that quietly routes traffic across enterprise environments rarely commands the same attention as endpoint security or cloud workloads — and sophisticated threat actors know it. A newly detailed campaign targeting Cisco Catalyst SD-WAN deployments illustrates precisely how that blind spot gets weaponized, with attackers achieving full root-level control over critical network fabric while systematically erasing every footprint along the way.

Security Impact: Network infrastructure that quietly routes traffic across enterprise environments rarely commands the same attention as endpoint security or cloud workloads — and sophisticated threat actors know it.

A Multi-Stage Intrusion Built on Chained Vulnerabilities

The attack chain dissected by Mandiant researchers doesn't rely on a single flaw. Instead, it represents a calculated, layered intrusion that began as early as March 2026 and targeted service provider infrastructure — environments where a single compromised device can cascade into downstream customer networks.

The initial foothold involved rogue SD-WAN peering connections established by the threat actor. Investigators believe earlier authentication bypass vulnerabilities in the Cisco Catalyst SD-WAN platform may have facilitated this entry, though the exact mechanism hasn't been confirmed with certainty. What is clear is that once inside, the attackers authenticated to SD-WAN Manager devices using a legitimate administrative account — the vmanage-admin credential — and began quietly mapping the environment.

The attackers changed the default administrator password, accessed the SD-WAN Manager web interface, and harvested configuration data for edge devices, controllers, and SD-WAN templates. In a telling detail that speaks to their operational discipline, they then restored the original administrator password — minimizing the window during which anomalous credential behavior might trigger an alert.

CVE-2026-20245: The Privilege Escalation Pivot

The campaign's most technically significant element centered on a high-severity command injection vulnerability, CVE-2026-20245, affecting Cisco Catalyst SD-WAN Manager, Controller, and Validator components. The flaw stems from insufficient validation of user-supplied input and enables authenticated attackers with local access to execute arbitrary commands at the root level by supplying a crafted file to the system.

In practice, the attackers exploited this through the platform's tenant-upload feature via the command-line interface. They uploaded a maliciously crafted CSV file — reportedly named evil_tenant.csv — that served as the delivery mechanism for their privilege escalation payload.

The malicious payload didn't simply seize root access. It first created backups of sensitive system files, including /etc/passwd and /etc/shadow, then created a new account with root-level privileges before using the Linux su command to switch from the compromised administrative session into full root control.

This sequencing — backup, escalate, operate, restore — reflects a mature operational playbook, not opportunistic exploitation.

Anti-Forensics as a First-Class Objective

What distinguishes this campaign from typical network device compromises is the deliberate, systematic effort to eliminate evidence of the intrusion. Anti-forensic tradecraft wasn't an afterthought — it appears to have been baked into the attack workflow from the start.

CVE-2026-20245: The Privilege Escalation Pivot
System configuration files were backed up before modification and restored afterward
The malicious CSV payload was deleted following successful exploitation
Temporary files created during the attack were removed
Evidence of the rogue root account was actively erased from the device
A validation script was executed to confirm the cleanup had been thorough

The execution of a dedicated validation step is particularly notable. It suggests the threat actor had either pre-built tooling for this environment or had invested significant preparation time understanding how forensic artifacts manifest on Cisco SD-WAN platforms — and how to eliminate them.

The Stolen Certificate Angle

One dimension of the investigation adds further complexity. Some of the rogue peering activity observed in March 2026 occurred on systems not vulnerable to the known authentication-bypass flaws. Cisco's own assessment suggested the attackers may have leveraged certificates stolen during a prior compromise to re-establish access — implying the threat actor had persistent footholds or credential caches predating this specific campaign.

This is a critical detail for any organization conducting incident response on SD-WAN infrastructure: patching the known vulnerability may not be sufficient if stolen certificates remain in circulation.

What You Should Do

Organizations running Cisco Catalyst SD-WAN deployments — particularly service providers and enterprises with large distributed footprints — should treat this campaign as an active threat requiring immediate action, not deferred patching.

  • Apply available patches immediately. Cisco has released fixed software versions for CVE-2026-20245. No workarounds exist; upgrading is the only remediation path.
  • Audit SD-WAN peering connections. Review current and historical peering records for unauthorized or unexpected connections. Treat any unrecognized peer as a potential indicator of compromise.
  • Collect and preserve diagnostic data. Pull device logs and diagnostic bundles from SD-WAN Manager, Controller, and Validator nodes before evidence degrades further or is actively cleared.
  • Review administrative account activity. Look for password change events, unusual login times, or configuration extraction activity — particularly involving the vmanage-admin account.
  • Audit issued certificates. If prior compromise is suspected, revoke and reissue authentication certificates used for SD-WAN peering to close potential re-entry paths.
  • Cross-reference published indicators of compromise. Mandiant has released attacker IP addresses and detection guidance that should be ingested into SIEM and network monitoring tools immediately.

The Broader Lesson

This campaign is a sharp reminder that network infrastructure — the backbone of enterprise connectivity — is both a high-value target and, historically, an under-monitored one. Attackers capable of chaining authentication bypasses with privilege escalation exploits while simultaneously executing anti-forensic cleanup are not unsophisticated. The tradecraft on display here aligns with nation-state or advanced criminal group capabilities.

Security teams should resist the temptation to treat SD-WAN and similar network control-plane components as outside the scope of their detection and response programs. If anything, the control a compromised SD-WAN controller provides over downstream traffic and configuration makes it one of the highest-impact targets in a modern enterprise environment.