AI Summary

Mandiant detailed a zero‑day campaign that leveraged CVE‑2026‑20245, a high‑severity command‑injection flaw in Cisco Catalyst SD‑WAN components (vManage, vSmart and vBond). By uploading a crafted file, authenticated attackers could execute arbitrary commands as root, enabling them to create rogue root accounts on the compromised devices. The report explains how the vulnerability was used to gain persistent privileged access across targeted SD‑WAN infrastructure.

AI summaries can be wrong sometimes—always verify important details using the source article.