Cisco SD-WAN Manager zero-day under active attack, no patch yet
Attackers are actively exploiting a zero-day in Cisco's Catalyst SD-WAN Manager $CSCO, the platform that controls enterprise networks, and no patch is available yet. The bug lets an attacker with network admin rights run commands as root and push configuration changes to edge dev
Attackers are actively exploiting a zero-day flaw in Cisco's Catalyst SD-WAN Manager $CSCO, the software that controls entire enterprise networks, and Cisco has not released a patch. The weakness sits in the command-line interface, which fails to properly check uploaded files, letting an attacker with network admin rights run commands as root. Cisco has observed real cases where intruders pushed configuration changes down to edge devices. It is the seventh SD-WAN zero-day the company has confirmed under attack in 2026. Google's Mandiant team reported the bug. Every deployment type is affected, including cloud, on-premises, and government versions. With no fix yet, Cisco urges customers to apply earlier SD-WAN updates, restrict admin accounts, and monitor for unexpected changes.