NetSight
IP …
high7.8Known exploited

CVE-2026-20245

Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability

Exploited in the wild

This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2026-06-09. Federal due date: 2026-06-23.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Impact

Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.

Affected products

VendorProductAffected versions
CiscoCatalyst Sd-Wan Manager
before 20.9.9.1
from 20.10 before 20.12.5.4
from 20.12.6 before 20.12.6.2
from 20.13 before 20.15.4.4
from 20.15.5 before 20.15.5.2
from 20.16 before 20.18.2.2
CiscoSd-Wan Vsmart Controller
before 20.9.9.1
from 20.10 before 20.12.5.4
from 20.12.6 before 20.12.6.2
from 20.13 before 20.15.4.4
from 20.15.5 before 20.15.5.2
from 20.16 before 20.18.2.2

Weakness classification

CWE-116

References