Executive summary

Mandiant's 24 June 2026 investigation describes a service-provider intrusion in which an attacker used administrative access to exploit CVE-2026-20245 in Cisco Catalyst software-defined wide area network (SD-WAN) infrastructure and obtain root privileges. The account manipulation and exploitation preceded the report, and the attacker subsequently removed files and restored configuration to reduce the forensic footprint. The US Cybersecurity and Infrastructure Security Agency (CISA) had added the flaw to its Known Exploited Vulnerabilities (KEV) catalogue on 9 June 2026. We assess it is likely (B2) that a response limited to updating software will leave important incident questions unanswered where rogue peer relationships or compromised administrative identities have already been observed.

Context: a control-plane intrusion, not a single request

Mandiant's report centres on a service provider's SD-WAN environment. It describes unauthorised peering connections from late 2025 into January 2026, further activity in March 2026, and observed exploitation in April 2026. The disclosure is new in June 2026; the observed intrusion is not.

The Canadian Cyber Centre's advisory records Cisco's disclosure on 4 June 2026 and the KEV addition on 9 June 2026. The historical CISA catalogue identifies an authenticated local privilege-escalation issue in Catalyst SD-WAN Manager. In the reported chain, the attacker already had an administrative position before exploiting this flaw. Describing it alone as an unauthenticated internet-to-root exploit would omit that prerequisite.

For defenders, the unit of investigation is therefore the control environment and its trust relationships, not just the vulnerable binary. A software inventory answers whether the flaw is present. It does not answer whether an unapproved peer, stolen certificate or compromised account was used before the update.

Technical analysis

Rogue peers and the limits of the initial-access finding

Mandiant reports that later rogue connections occurred on a device running a version unaffected by one earlier peering vulnerability. Cisco also ruled out another previously disclosed flaw as the explanation for those connections. The investigators identify previously stolen certificate material as a possible route, and explicitly say they cannot establish whether the same actor conducted the earlier and later rogue-peering activity.

That uncertainty should remain in an incident timeline. It supports examining certificate history and approved peers, but it does not prove that a particular certificate was stolen in every affected deployment. Nor does it justify combining all suspicious peering events into one actor's continuous operation without further evidence.

Administrative account changes preceded escalation

In the March 2026 activity, the attacker authenticated through Secure Shell (SSH) using the vmanage-admin account, changed the default admin password and accessed the management web interface. Mandiant reports extraction of SD-WAN configuration and a subsequent return of the password to its previous state. It notes that the two default accounts have different privileges and neither provides root shell access.

The password restoration matters to investigation. A current configuration that looks familiar can coexist with a history of unauthorised changes. Our recommended check is to compare authentication records, account-change events and configuration history over the relevant period. Treat their ordering as part of the evidence; the current password state alone cannot reconstruct the earlier session.

The upload function provided root access

Mandiant observed exploitation of CVE-2026-20245 in April 2026 through a crafted file supplied to the affected command-line upload function. The malicious input resulted in privileged account changes, including creation of an account called troot. The report describes backups of original configuration and account files, followed by access to that newly created privileged account.

This article does not reproduce the payload or the exploit command. For detection, the useful relationship is an administrative upload followed by unexpected account changes or a privileged session. The upload filename in the investigated case was evil_tenant.csv; it is an observed artefact, not a required filename for every exploitation attempt.

Cleanup was part of the operation

Mandiant says the actor deleted created files, restored altered configuration and ran checks to verify the removal of indicators. The report's recovered artefacts were therefore incomplete. That supports a specific investigative caution: the absence of the named file or account on a currently running device is not, by itself, evidence that the activity never occurred.

Our recommendation is to search historical evidence and correlate multiple sources. Authentication records, configuration deltas and script logs may describe different portions of the same sequence. Where retention is insufficient, record that limitation and let it inform the recovery decision instead of treating a negative search as a definitive clean bill of health.

Impact and scope

The reported consequence was root-level access after compromise of administrative access, together with extraction of network configuration. Mandiant discusses the importance of central orchestration systems and the challenge of investigating appliances with limited telemetry. The report does not establish a universal number of affected providers, identify a named victim organisation, or provide a measured financial impact.

An affected operator should assess the functions its controller can exercise, the secrets and configuration available to the accessed account, and the downstream systems reachable from that position. Those are scoping recommendations, not assertions that every possible downstream action occurred. Separate potential reach from observed activity in the incident report.

For managed services, preserve the relationship between control-plane evidence and the customers or network segments it could affect. A shared platform may require coordinated investigation without assuming that every connected tenant was compromised. Record the basis for including or excluding each part of the environment.

Indicators and hunting guidance

The following artefacts come from Mandiant's investigation. They support a hunt when interpreted in context; the attacker reportedly removed several of them.

Artefact or behaviour Investigative use Limitation
evil_tenant.csv Search retained upload and script records for the observed file. Filename changes are possible; absence does not exclude exploitation.
troot account Review account history and privileged-session evidence. The actor reportedly removed traces after use.
.orig_passwd and .orig_shadow under /home/admin/ Look for backups associated with account-file changes. These were case-specific artefacts, not a complete detection set.
Unexpected SSH use of vmanage-admin Establish source, timing and subsequent account changes. Compare with approved administration.
Rapid change and restoration of admin credentials Correlate with configuration access and other session activity. A change alone can have a legitimate explanation.

Mandiant recommends examining authentication logs, configuration rollback records and script logs. It warns that some indicators resemble legitimate administration and should be assessed against the normal network posture. Our recommendation is to preserve the relevant records before upgrades or other recovery actions alter retention, then record which sources were available for each conclusion.

Incident-response priorities

Mandiant advises collecting diagnostic material across control-plane components, hunting for the published behaviours and conducting a full investigation when genuine indicators are found. It directs suspicious activity and confirmed indicators to Cisco's Technical Assistance Center (TAC) for review and remediation assistance.

Our suggested response sequence is:

  1. Identify the affected management systems, software versions, approved peers and administrative owners.
  2. Preserve diagnostic collections and relevant off-device records, documenting time coverage and gaps.
  3. Investigate unexpected peers, administrative sessions, password changes and configuration extraction together.
  4. Apply the appropriate fixed software and obtain vendor-supported recovery guidance where compromise is evidenced.
  5. Review credentials, certificates and configuration that could have been exposed, then validate restored control relationships.

Do not equate completion of step four with completion of the entire incident. Conversely, do not claim certificate theft solely because the report presents it as a possible explanation. Keep the operational action and the strength of the supporting evidence visible beside each other.

Threat-intelligence context

The observed use of compromised administration is consistent with MITRE ATT&CK T1078, Valid Accounts. The reported removal of created files is consistent with T1070.004, File Deletion. These are analyst mappings of reported behaviour, not new attribution evidence.

Mandiant does not establish a named threat group for this case. Its discussion of strategic value should not be converted into a confident country attribution. Detection and recovery can proceed without that label: an unapproved peer relationship or unexplained privileged account is actionable on its own evidence.

Mitigation and software verification

Mandiant's 24 June 2026 report lists the following fixed Manager releases, or later releases, for CVE-2026-20245. Operators should confirm the supported upgrade path with Cisco for their deployment.

Release branch Fixed release listed by Mandiant
20.9 20.9.9.2
20.12 20.12.7.2
20.15 20.15.4.5 or 20.15.5.3
20.18 20.18.3.1
26.1 26.1.1.2

The version list is a remediation reference, not proof that an updated device was never compromised. Our recommendation is to record both the installed version and the investigation disposition. Verify expected peers, administrator identities and configuration after recovery. Confirm that monitoring can detect the account and script events used in the investigation, rather than assuming that a successful upgrade preserves every needed log.

Historical context and outlook

The case links activity across several periods, but the source leaves the relationship between earlier and later rogue peers unresolved. That is a useful example of why a long incident timeline should retain its evidence boundaries. An earlier exposure can inform the scope without proving that every later event has the same origin.

We assess it is likely (B2) that trust and identity review will be the decisive follow-through for deployments with evidence of this chain. The basis is the administrative prerequisite, the possible reuse of earlier trust material and the deliberate cleanup described by Mandiant. This is a mechanism-based assessment, not an estimate of the prevalence of hidden compromise across Cisco customers.

The investigation should close with a documented explanation of what was restored, what was searched and what could not be established. That gives operators a defensible basis for returning the control environment to service while preserving unresolved questions for follow-up.

Further reading