UAT-8616 evil_tenant.csv Malicious Payload on Cisco SD-WAN Manager

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•4

Detects the upload and execution of a specific malicious CSV file (evil_tenant.csv) on Cisco SD-WAN Manager (vManage) systems. This file is associated with exploitation of CVE-2026-20245, enabling attackers to inject a persistent root backdoor account into the system files.