Mandiant reports Cisco SD WAN zero day exploited for months

A sophisticated cyberattack campaign exploited a critical vulnerability in Cisco's software-defined networking products for months before the flaw was publicly disclosed, according to a new report from Google-owned Mandiant. The campaign, which targeted a communications service provider, highlights a growing trend of attackers focusing on network infrastructure to gain persistent, stealthy access to corporate environments.

The vulnerability, tracked as CVE-2026-20245, is a privilege escalation flaw in the command-line interface of Cisco Catalyst SD-WAN Manager. It allows an authenticated attacker with local access to execute arbitrary commands with full root-level privileges by uploading a specially crafted file. Cisco disclosed the flaw and released patches in early June 2026, noting it had been exploited in a limited number of attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its catalog of known exploited vulnerabilities on June 4.

Researchers from Mandiant reported that exploitation began at least two months prior to disclosure, with observed malicious activity in March 2026. The attack involved two distinct periods of unauthorized access....