CVE-2026-20245 Cisco SD-WAN Privilege Escalation via evil_tenant.csv and troot Account

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects indicators of exploitation related to CVE-2026-20245 on Cisco Catalyst SD-WAN controllers, including malicious tenant CSV uploads, unauthorized account creation (troot), privilege escalation via su, anti-forensic backup of system configuration files, and configuration changes such as PermitRootLogin enabled.