Cisco SD-WAN Privilege Escalation via CVE-2026-20245/CVE-2022-20775: troot Account & evil_tenant.csv

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•5

Detects post-exploitation activities on SD-WAN appliances, including unauthorized tenant list uploads related to CVE-2026-20245, creation of unauthorized 'troot' accounts in sensitive system files, staging of system files, unauthorized permission modifications via chmod/chown, and privilege escalation attempts using su.