CVE-2026-20245: Mandiant Reconstructs the Attack — A Malicious CSV, a ’troot’ Account, and a Communications Provider Compromised Months Before Cisco Knew

Publication date: June 25, 2026 Category: Information Security · Threat Intelligence · Network Security

Mandiant’s Forensic Findings: The Full Case

On June 25, 2026, Google Mandiant published the forensic reconstruction of the exploitation of CVE-2026-20245 against Cisco Catalyst SD-WAN infrastructure, documenting in detail the two waves of malicious activity, the technical mechanisms used, and the actor’s anti-forensic tactics.

An unknown threat actor compromised the SD-WAN infrastructure of a communications service provider at least two months before the vulnerability was publicly disclosed on June 5, 2026. Activity unfolded across two distinct waves: one between late 2025 and January 2026, and a second in March 2026. Whether both waves belong to the same actor has not been confirmed.

The technical vector was a specially crafted CSV file — named evil_tenant.csv — which, when processed by the system, created a hidden user account called troot with full root privileges over the SD-WAN Manager. After completing their objectives, the actor systematically deleted all evidence using automated anti-forensic techniques, including a validation script that confirmed the removal of indicators before terminating the session.

Mandiant’s operational conclusion: the actor operated with impunity for weeks inside critical network infrastructure, with Cisco unaware of the vulnerability and the victim provider structurally unable to detect the intrusion given the level of forensic cleanup performed.

Context: Eight SD-WAN Vulnerabilities in 2026

CVE-2026-20245 is the seventh in a series of actively exploited vulnerabilities in the Cisco SD-WAN ecosystem during 2026. On June 15, CISA added an eighth — CVE-2026-20262 — to the KEV catalog. Patches for CVE-2026-20245 were published on June 10. The accumulation is no longer interpretable as isolated incidents: the components implicated — vdaemon, the CLI, the NETCONF channel, the HTTP upload flow — map to contiguous regions of the SD-WAN Manager codebase, pointing to structural security technical debt.

Mandiant’s forensic analysis confirms that the threat actor had been operating against this ecosystem since at least late 2025, long before any of these vulnerabilities were publicly known.

The Attack in Detail: Forensic Reconstruction

First wave — Late 2025 to January 2026

The victim observed unauthorized peering connections on its SD-WAN infrastructure. Mandiant assessed that these connections likely exploited CVE-2026-20127 or CVE-2026-20182 — both of which were undisclosed zero-days at that point — to establish initial access to the control plane.

Second wave — March 2026

The actor established new unauthorized peering connections and authenticated against SD-WAN Manager devices using the vmanage-admin account. Cisco confirmed to Mandiant researchers that this second wave did not leverage CVE-2026-20182, and that the affected devices had already been patched against CVE-2026-20127.

Mandiant’s assessment: the actor likely used certificates stolen during a prior compromise of the same device to re-authenticate — which introduces a critical dimension that subsequent patches do not address. If the actor already holds valid certificates extracted from a prior breach, patching the known authentication vulnerabilities does not prevent re-entry.

The step-by-step exploitation sequence

Once inside with administrative account access, the sequence documented by Mandiant was as follows:

1. The actor authenticated to the SD-WAN Manager via SSH using the vmanage-admin account through the unauthorized peering connection.

2. Changed the default admin account password.

3. Authenticated directly to the SD-WAN Manager web interface using the admin account.

4. Exfiltrated SD-WAN fabric configurations: edge devices, controllers, and network configuration templates.

5. Executed the CVE-2026-20245 exploitation command:

request tenant-upload tenant-list /home/admin/evil_tenant.csv vpn 0

6. The evil_tenant.csv file contained the exploit payload, designed to append malicious entries to /etc/passwd and /etc/shadow — the two central authentication databases of the underlying Linux operating system.

7. Before executing the exploit, the actor created backups of the original vbond_vsmart_tenant_list, /etc/passwd, and /etc/shadow files to enable restoration afterward without leaving detectable changes.

8. Payload execution created the troot account with full root-level privileges.

9. The actor used the Linux su troot command to elevate from the admin session to the root shell.

10. Objectives completed, the actor executed the cleanup sequence:

• Deleted evil_tenant.csv and all files created during the operation
• Restored /etc/passwd and /etc/shadow to their original states
• Restored the vbond_vsmart_tenant_list file to its pre-exploit state
• Changed the admin account password back to its original value — so any administrator logging in afterward would notice nothing anomalous
• Executed a validation script to confirm no indicators of the intrusion remained before closing the session

Why the Target Is a Communications Provider

The target selection is not coincidental. Compromising a communications service provider’s SD-WAN Manager is not equivalent to compromising a single organization’s network — it is equivalent to gaining potential visibility into the traffic of every customer that provider manages across its SD-WAN fabric.

As Mandiant Consulting CTO Charles Carmakal stated: network devices like SD-WAN Manager do not natively support EDR solutions, making them the preferred target of advanced actors seeking long-term persistence outside the reach of conventional security controls. A foothold in the SD-WAN control plane provides persistent visibility into internal traffic across the entire network fabric without needing to compromise individual endpoints.

Mandiant found no evidence that the actor used the access to actively monitor customer communications. However, investigators could not establish the full extent of post-compromise activity precisely because of the anti-forensic techniques employed — absence of evidence is not evidence of absence.

Operational Sophistication: Living Off the Edge

Mandiant’s report introduces the term “living off the edge” to describe the actor’s tactical pattern: rather than introducing external tools that might trigger detection, the actor abused legitimate SD-WAN fabric functionality — the peering mechanism, the tenant upload system, VPN access — to move between components and execute the attack.

This pattern has direct defensive implications: detection systems based on signatures of known malicious tools are blind to this type of attack, because the actor’s actions are structurally indistinguishable from legitimate administrative operations. The difference lies in context — which account, from which origin, with which certificates, at what time — not in the type of operation performed.

Indicators Mandiant highlights as relevant for threat hunting in this context include:

• Unauthorized SD-WAN peering connections, particularly from IP ranges not documented in change management records
• Invocations of request tenant-upload with files located in user directories (/home/admin/) rather than expected system paths
• SSH access to the vmanage-admin account outside documented maintenance windows
• Modifications to /etc/passwd or /etc/shadow not correlated with authorized account management operations
• Undocumented accounts in system authentication files — particularly accounts with UID 0 (root)
• SD-WAN certificates presented from devices or IPs not registered in the asset inventory

Mandiant published indicators of compromise (IOCs) — including attacker IP addresses — in a GTI Collection freely accessible to registered users.

The Alternative Access Vector: Stolen Certificates

One of the most significant findings in the report is the confirmation that the second wave of attacks did not use any of the known authentication vulnerabilities. Cisco determined that the access method was different, and Mandiant’s operational hypothesis is that the actor used digital certificates stolen during the first wave compromise to re-authenticate against devices that had already been patched against CVE-2026-20127 and CVE-2026-20182.

The implications are considerable. Digital certificates are long-lived credentials that in many SD-WAN deployments are not routinely rotated. An actor who exfiltrated certificates during an initial intrusion can retain access capability indefinitely, even after the vulnerabilities that facilitated that initial access are patched. This makes certificate revocation and rotation a mandatory — not optional — remediation step for any organization that suspects prior compromise.

Patch Status and the Vulnerability Ecosystem

The patch for CVE-2026-20245 was published on June 10, 2026. Fixed versions by branch:

CISA added CVE-2026-20245 to the KEV catalog on June 9, with the federal deadline on June 23, 2026. On June 15 it also incorporated CVE-2026-20262 (path traversal in SD-WAN Manager, CWE-22, CVSS 6.5), with a deadline of June 29, 2026. Additionally, eight public PoCs are available on GitHub for CVE-2026-20245.

A critical technical note: applying only the CVE-2026-20182 patch (May) does not fix CVE-2026-20245 — they are separate fixes for separate release versions. Organizations that updated in May need a second, specific update.

Remediation Actions in Priority Order

1. Patch CVE-2026-20245 to the corresponding fixed version from the table above. If CVE-2026-20182 patches were already applied, this is an additional step — not a redundant one.

2. Patch CVE-2026-20262 with equal urgency, as it is the second actively exploited vulnerability in the same component, with a federal deadline of June 29, 2026.

3. Revoke and rotate all SD-WAN certificates in the environment. The Mandiant report confirms that certificates are an access vector independent of vulnerability patches. Without this action, an actor holding certificates stolen from a prior compromise retains re-entry capability.

4. Before any action, run request admin-tech from each deployment component (Manager, Controller, Validator) to preserve forensic evidence.

5. Audit SD-WAN peering connections against the authorized inventory. Any peering connection from an undocumented IP or device must be treated as an active indicator of compromise.

6. Review /etc/passwd and /etc/shadow for undocumented accounts, especially those with UID 0. The troot account was deleted by the actor, but in similar compromises, artifacts may remain if cleanup was imperfect.

7. Correlate request tenant-upload invocations in logs against documented administrative sessions and authorized change windows.

8. If there is evidence of compromise, do not patch without engaging Cisco TAC — restoring a system compromised at this level requires guided remediation, not just a software update.

Complete Incident Timeline

Wrapping Up…

Mandiant’s forensic analysis documents an actor operating for weeks inside critical network infrastructure belonging to a communications provider, undetected, using the system’s own legitimate functionality as the attack vector and automated anti-forensic techniques to erase all evidence before withdrawing.

Three structural conclusions emerge from the analysis. First: network devices without EDR support are the preferred target of advanced actors precisely because available forensic telemetry is limited — the “living off the edge” pattern is designed to exploit that gap. Second: digital certificates are long-lived credentials that outlast vulnerability patches; without active rotation, an actor with stolen certificates retains indefinite access capability. Third: the accumulation of eight exploited CVEs in the same ecosystem over six months, with an actor operating since at least late 2025, confirms this is a sustained campaign with deliberate targeting of Cisco SD-WAN infrastructure, not a series of opportunistic incidents.

For security teams, the central question is not only patching — it is determining whether the environment was already compromised before the patch existed. Mandiant’s report provides the indicators and methodology to investigate that.

Sources consulted:

• Sng, C., Boonyakarn, P., Nadarajan, L. “Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager” — Google Cloud / Mandiant Threat Intelligence (June 25, 2026)
• Lakshmanan, R. “Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access” — The Hacker News (June 25, 2026)
• Gatlan, S. “Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access” — BleepingComputer (June 25, 2026)
• The Register. “The hits keep on coming for Cisco vulnerabilities” — The Register (June 24–25, 2026)
• Security Affairs. “Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited Months Before Disclosure” — Security Affairs (June 25, 2026)
• Cisco PSIRT. “Cisco Catalyst SD-WAN Controller, Manager, and Validator Authenticated Privilege Escalation Vulnerability” — Cisco Security Advisory (cisco-sa-sdwan-privesc-4uxFrdzx), updated June 2026
• CISA. “CISA Adds Three Known Exploited Vulnerabilities to Catalog” — CISA (June 9, 2026)
• Lakshmanan, R. “The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes” — The Hacker News (June 19, 2026)
• TechTimes. “Cisco SD-WAN Zero-Day Exploit: Mandiant Reveals Malicious CSV Opened Root Shell” — TechTimes (June 25, 2026)