CVE-2026-20245 Cisco SD-WAN Manager Root Privilege Escalation via evil_tenant.csv

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•7

This rule detects indicators of exploitation for CVE-2026-20245 in Cisco Catalyst SD-WAN Manager. It monitors for the upload of malicious tenant configuration files, the creation of unauthorized 'troot' administrative accounts, subsequent lateral movement via 'su', modifications to critical system authentication files like /etc/passwd or /etc/shadow, and post-exploitation configuration exfiltration via REST API endpoints.