Cisco has released an advisory for a Medium Severity, Arbitrary File Write Vulnerability in Cisco Catalyst SD-WAN Manager. The vulnerability has a patch available. It has been reported by Cisco as EITW as of June 2026. It has no workarounds. It does require an authenticated account.
Cisco’s Advisory:
Actions
Update Cisco Catalyst SD-WAN Manager to the latest available version.
Cisco has also released some log entries for IOCs, though they can include false positives and should be compared with regular activity:
Customers are encouraged to audit the following entries from their respective log files:
From the vmanage-server.log file, located at /var/log/nms:
11-June-2026 03:53:37,310 EDT INFO [a66cdc5f-807d-4c23-944e-5c809a2ece6b] [server] [SdraAnyConnectFileUploadHandler] (default task-40704) |default| uploaded Remote Access Anyconnect profile file: ../../../../var/lib/wildfly/standalone/deployments/suspicious.war to vManage.
From the vmanage-appserver.log file, located at /var/log/nms/:
11-June-2026 07:52:55,275 UTC INFO [server] (DeploymentScanner-threads - 2) WFLYSRV0010: Deployed "suspicious.war" (runtime-name : "suspicious.war")
From the serviceproxy-access.log file, located at /var/log/nms/containers/service-proxy/:
Note: This activity is restricted to internal system file management within the vManage (Catalyst SD-WAN Manager) environment. It does not correlate to, nor does it affect, the operational state, configuration, or connectivity of the SD-WAN Remote Access (SDRA) feature. Customers who observe these logs and are uncertain about their origin or intent should contact the Cisco Technical Assistance Center (TAC) for further assistance.
Edit: I guess I am losing track of the number of Cisco vulnerabilities. The Google blogpost described below is related to CVE-2026-20245, not CVE-2026-20262 as in the topic start.
Rogue Peering and Credential Manipulation: In March 2026, a threat actor established initial access via unauthorized peering connections to facilitate Secure Shell (SSH) access. The threat actor used that access to manipulate default account passwords to evade detection.
Exploitation of CVE-2026-20245: Subsequently, the attacker leveraged a zero-day privilege escalation vulnerability (now tracked as CVE-2026-20245) in Cisco Catalyst SD-WAN Manager to gain root-level access via a malicious CSV upload.
Extensive Anti-Forensic Cleanup: The threat actor deleted malicious files, reverted configuration changes, and executed a validation script to ensure indicators are purged.
New indicators of compromise
Description
Indicator type
Indicator
IP address connecting as rogue device and exploiting CVE-2026-20245
ipv4-addr
126.51.108.152
IP address connecting as rogue device
ipv4-addr
76.92.245.217
IP address connecting as rogue device
ipv4-addr
207.190.37.94
IP address connecting as rogue device
ipv4-addr
23.245.7.178
IP address connecting as rogue device
ipv4-addr
153.186.231.233
IP address connecting as rogue device
ipv4-addr
167.179.79.189
IP address connecting as rogue device
ipv4-addr
45.32.38.160
IP address connecting as rogue device
ipv4-addr
209.137.225.101
The report describes a period “from late 2025 to January 2026” but also notes that not all activity may be related to the same threat actor.
Residential proxy networks
Two IP addresses related to ASN 20473 (Vultr). All other IP addresses correlate historically with ASUS Router web interfaces. FOFA history goes back a bit further compared to the others (Shodan, Driftnet). I do not have a Censys account, but suspect the history of these IPs will show the same (let me know if you can check!). I do not know if the timestamps of the attacks described actually overlap with the interfaces described here. Residential ISP IP addresses rotate fast enough for this to be just a coincidence.
IP address
Web interface
23.245.7.178
ASUS Wireless Router ZenWiFi AX (2026-06-01)
209.137.225.101
ASUS Wireless Router RT-AC67P (2026-01-20)
207.190.37.94
ASUS Wireless Router RT-AC65 (2026-01-07)
76.92.245.217
ASUS Wireless Router RT-AC65 (2026-06-23)
126.51.108.152
ASUS Wireless Router ZenWiFi AX (2026-04-09)
153.186.231.233
ASUS Wireless Router TUF-AX3000 (2026-01-28)
ASUS Routers are often mentioned when it comes to residential proxy networks or botnets. They were included in a number of networks like AyySSHush and Quad7
My take, based on some big assumptions, is that this incident report once again underlines that just blocking ‘known bad hosting providers’ is no longer sufficient. Even consumer internet service providers in trusted countries will not prevent you from getting attacked from these networks. Tracking and blocking ‘all potentially vulnerable’ devices is likely undoable due to rotating IP addresses and the sheer number of devices out there.