A patched SSRF bug in Unified Communications Manager is now being weaponised in the wild, while a Cisco Catalyst SD-WAN zero-day was exploited significantly earlier than the vendor’s advisory acknowledged.
Summary
- CVE-2026-20230, a server-side request forgery flaw in Cisco Unified Communications Manager, is being actively exploited following the public availability of proof-of-concept code.
- Attackers are chaining the UCM SSRF to deploy a rogue Apache Axis service and drop a command-execution shell, ultimately enabling root-level access.
- CVE-2026-20245, a Cisco Catalyst SD-WAN privilege-escalation zero-day, was exploited at a communications service provider well before Cisco’s June 2026 disclosure date.
- The SD-WAN attacker used a crafted CSV file to escalate from a compromised admin account to a newly created root-level user, then attempted to cover tracks by restoring the original password.
- This is Cisco’s sixth SD-WAN vulnerability listed as under active attack since the start of 2026, and the second zero-day in two months.
Two vulnerabilities, two active exploit chains
Cisco is contending with two separate and serious exploitation events this week. The first involves CVE-2026-20230, a server-side request forgery vulnerability in Cisco Unified Communications Manager that the company patched in early June. The second is CVE-2026-20245, a privilege-escalation zero-day in Cisco Catalyst SD-WAN that Mandiant has now confirmed was exploited at a communications service provider earlier in 2026 — well before Cisco’s official June advisory.
UCM SSRF: from patch to active exploit in weeks
Cisco disclosed CVE-2026-20230 in early June and noted at the time that proof-of-concept exploit code already existed. The vulnerability stems from improper validation of certain HTTP requests in Unified Communications Manager, and successful exploitation can grant root privileges on the affected device. Threat intelligence firm Defused has now reported observing active exploitation over a recent weekend, describing a multi-stage attack chain.
A layered attack chain
According to Defused, attackers are abusing the WebDialer SSRF component to deploy a rogue Apache Axis service. That service is then used to write an initial JSP file-writer, which in turn drops a second-stage command-execution shell under a platform-services directory path. The complexity of this chain suggests the actors involved have invested meaningful effort in operationalising the exploit, rather than conducting opportunistic scanning.
SD-WAN zero-day: the timeline was worse than reported
The SD-WAN situation carries additional weight. Cisco’s June advisory stated the company became aware of exploitation of CVE-2026-20245 that month. Mandiant’s investigation tells a different story: the firm identified a threat actor targeting SD-WAN infrastructure at a service provider in early 2026. Pete Boonyakarn, Senior Cyber Security Consultant at Mandiant — Google Cloud, explained to The Register that Mandiant suspected a zero-day during initial investigation but required deeper forensic analysis to confirm it. The June date reflects when the vulnerability was officially validated, patched, and disclosed — not when exploitation began.
How the SD-WAN intrusion unfolded
Mandiant’s account of the attack is methodical. The threat actor gained initial access through an unauthorised peering connection, exploiting the SD-WAN fabric’s authentication mechanisms to obtain SSH access via the vmanage-admin account. The attacker then authenticated to the SD-WAN Manager web interface using the admin account, changed its default password, and exfiltrated SD-WAN fabric configurations. Before disconnecting, they restored the admin password to its original value — a deliberate move to limit detection.
Root access via a crafted CSV file
Neither the vmanage-admin nor the admin accounts carry root shell access by default. To bridge that gap, the attacker exploited CVE-2026-20245, which permits an authenticated local attacker to execute arbitrary commands as root by supplying a crafted file to the system. In this case, the attacker uploaded a file named evil_tenant.csv containing the exploit payload. Upon execution, a new user account named troot was created with full root privileges. Mandiant later observed the attacker accessing the troot account from the admin account using the substitute user command.
Why SD-WAN devices remain a priority target
A compromised SD-WAN controller can provide an attacker with visibility across an organisation’s entire internet traffic flow. This makes these devices a priority objective for sophisticated actors — including those engaged in long-term, low-and-slow espionage campaigns. CVE-2026-20245 is the sixth Cisco SD-WAN vulnerability recorded as under active attack since January 2026 and the second zero-day in two months. Mandiant has not publicly attributed the SD-WAN intrusion to a specific threat actor.
Why it matters
For CISOs, the convergence of these two incidents illustrates a pattern that demands structured attention rather than reactive patching alone. The UCM SSRF moved from disclosed vulnerability with available proof-of-concept to active exploitation in a matter of weeks — a window that many organisations will have failed to close. The SD-WAN intrusion is arguably more concerning: it demonstrates that sophisticated actors are operating inside network infrastructure ahead of vendor disclosure timelines, using careful tradecraft such as credential restoration to suppress detection. Organisations running Cisco Catalyst SD-WAN or Unified Communications Manager at any scale should treat both CVEs as high-priority remediation items. The SD-WAN case in particular suggests that even administrative accounts with limited baseline privileges can serve as a reliable launchpad to full root compromise when a suitable vulnerability exists. Network visibility tools and anomaly detection on administrative account activity are worth reviewing.
What to do now
- Apply Cisco’s June 2026 patch for CVE-2026-20230 in Unified Communications Manager immediately if not already done, given confirmed active exploitation.
- Apply Cisco’s patch for CVE-2026-20245 in Cisco Catalyst SD-WAN and review Cisco’s June advisory guidance for any additional mitigations specified.
- Audit SD-WAN administrative account activity, including SSH access logs and any recent password changes on vmanage-admin and admin accounts.
- Review SD-WAN fabric configurations for unauthorised peering connections or unexpected changes that may indicate prior compromise.
- Check for the presence of unfamiliar local user accounts on Cisco Catalyst SD-WAN controllers, particularly any accounts created with elevated or root-level privileges.
- If Cisco Unified Communications Manager is deployed, search web server logs and platform-services directories for evidence of unexpected JSP files or Axis service deployment consistent with the described attack chain.
