CVE-2026-20245 Cisco SD-WAN Manager evil_tenant.csv root escalation

Ibrahim Saud@tektrix

•updated Jun 29, 2026•6•1•29

This rule monitors system and audit logs on network appliances (like Cisco vManage) for unauthorized attempts to escalate privileges to a rogue root user ('troot') and suspicious file manipulation or command execution related to tenant list management, often associated with exploitation of specific vulnerabilities.