Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access

A high-severity security flaw in Cisco Catalyst SD-WAN, tracked as CVE-2026-20245, was exploited by an unknown threat actor as a zero-day for at least two months before public disclosure. Mandiant found the vulnerability allows an authenticated, local attacker to execute arbitrary commands with elevated privileges.