CVE-2026-20245

Vulnerability overview

A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks o...

Affected product and versions

Product

Cisco Cisco Catalyst SD-WAN Controller, Cisco Catalyst SD-WAN Manager, catalyst sd-wan manager

Affected versions

>= 20.6.4, >= 20.9.2, >= 20.3.6, >= 20.7.2, >= 20.7.1, >= 20.5.1, >= 20.6.2, >= 19.3.0, >= 20.6.1, >= 17.2.4, >= 18.2.0, >= 18.4.6, >= 19.1.0, >= 19.2.4, >= 19.2.929, >= 18.3.8, >= 18.4.303, >= 18.3.7, >= 18.4.1, >= 19.2.097

Fixed versions

20.9.9.1, 20.12.5.4, 20.12.6.2, 20.15.4.4, 20.15.5.2, 20.18.2.2, 26.1.1.1

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-116

KEV added

2026.06.09

Ransomware use

미확인