Cisco discloses critical vulnerabilities in SD-WAN and ISE platforms

Cisco has disclosed two major security vulnerabilities currently being exploited in the wild, affecting critical network management and access control platforms.

In the first incident, attackers exploited a local privilege-escalation flaw (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager. By leveraging rogue peering to gain SSH access via default credentials, attackers were able to upload a malicious CSV file to achieve root access. This compromise allowed for configuration exfiltration and the use of anti-forensic techniques to delete logs.

Separately, a maximum-severity authentication bypass vulnerability (CVE-2026-76460) has been identified in Cisco Identity Services Engine (ISE) and Cisco ISE-PIC. This flaw, which carries a CVSS score of 10.0, allows unauthenticated remote attackers to bypass authentication on an API endpoint to gain root privileges on the appliance. Cisco confirmed that this vulnerability is under active exploitation, with attackers capable of executing commands and erasing log entries to conceal their presence.