Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access
2026-06-25T07:24:35Z•bd194778af9388836f75013f5be550ab162822fc9f98c67326703594fed0b7df
AmadeyCI/CDCiscoCordycepsFortiGateGitHub-ActionsLantronixOpenAI-GPT-5.5-CyberStealCWhatsApp-malspamactive-exploitationcredential-harvestlaw-enforcement-takedownnpm-malwarepost-quantum-cryptosupply-chainzero-day
What happened
A cluster of high-impact security incidents and patches: Mandiant reports an unknown actor exploited a recently disclosed Cisco Catalyst SD‑WAN zero‑day (CVE‑2026‑20245) months before public disclosure to gain elevated privileges. CISA warns of active exploitation of a critical Lantronix EDS5000 code‑injection flaw (CVE‑2025‑67038, CVSS 9.8) and urged immediate patching; separately, a Cisco Unified CM flaw (CVE‑2026‑20230, CVSS 8.6) is being exploited after a PoC revealed a file‑write to root. Large-scale campaigns and supply‑chain threats were also reported: the FortiBleed operation harvested
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- bd194778af9388836f75013f5be550ab162822fc9f98c67326703594fed0b7df
- Enrichment time
- 2026-06-25T07:24:35Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.