The Cipher

Cisco has disclosed yet another unpatched zero-day in its Catalyst SD-WAN Manager platform — the seventh such vulnerability in this product line to be actively exploited so far this year. CVE-2026-20245 allows an unauthenticated attacker to escalate privileges all the way to root. There is currently no patch available.

Let that number sink in for a moment: seven. That's not a bad luck streak. That's a pattern.

SD-WAN sits at the edge of enterprise networks — it's the gear that connects branch offices, cloud workloads, and remote sites back to the mothership. Root access on that box means an attacker is effectively sitting at the front door with a master key. For any organisation running Catalyst SD-WAN Manager, this is a "get the CISO on the phone" situation, not a "add it to the backlog" one.

Cisco's advisory offers the usual mitigation guidance — restrict management interface access, monitor for anomalous activity — but the absence of a patch means defenders are playing defence without a proper shield. The company says it is working on a fix, without a committed timeline.

Why this keeps happening deserves more attention than the individual CVE. Cisco's SD-WAN portfolio has been a consistent source of critical, exploited flaws throughout 2026. Security researchers point to a combination of factors: the product's complexity, a large exposed attack surface (SD-WAN managers are frequently internet-accessible for operational convenience), and a codebase that has grown through acquisitions rather than being built clean. The result is a product that enterprises depend on for the core of their network architecture, with a security track record that should be giving procurement teams serious pause.

For defenders right now: if your SD-WAN Manager has a management interface reachable from the internet, take it off. That single step removes the most likely attack vector while you wait for a patch. Verizon's 2026 DBIR, released this week, reinforces the point — network edge devices remain one of the most common initial access vectors, precisely because they're internet-facing and often under-patched.

The Australian angle is real here. SD-WAN is widely deployed across Australian enterprise and government networks, and the ACSC has previously flagged Cisco vulnerabilities in its "patch now" advisories. Organisations covered by the SOCI Act — particularly those in the communications, energy, and financial services sectors — should be checking their exposure today, not waiting for a coordinated advisory.

The broader question this raises: at what point does a seven-zero-days-in-one-year track record trigger a harder conversation about whether a critical-infrastructure product meets the security bar it's supposed to? That's a question for vendors, regulators, and procurement teams alike — and it's increasingly one that Australian frameworks like the Essential Eight and SOCI Act risk assessments are going to have to grapple with directly.