CVE-2026-20245 Google Chronicle · YARA-L

Detect Cisco Catalyst SD-WAN Manager Improper Output Encoding Exploitation in Google Chronicle

Detects exploitation attempts targeting CVE-2026-20245, an improper encoding or escaping of output vulnerability (CWE-116) in Cisco Catalyst SD-WAN Manager. This vulnerability is actively exploited in the wild (CISA KEV) and may allow attackers to perform privilege escalation or inject malicious content through improperly encoded output. Detection focuses on anomalous authentication patterns, unexpected privilege changes, API abuse, and suspicious management plane activity against SD-WAN Manager instances.

MITRE ATT&CK

Tactic
Privilege Escalation Initial Access Lateral Movement

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule CVE_2026_20245_Cisco_SDWAN_Output_Encoding_Exploitation {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects potential exploitation of CVE-2026-20245 in Cisco Catalyst SD-WAN Manager"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx"

  events:
    ($e1.metadata.product_name = /vmanage|sd-wan manager|catalyst sd-wan/i
      or $e1.target.hostname = /vmanage|sdwan.?manager|sdwanmgr/i)
    and (
      $e1.metadata.description = /privilege.escal/i
      or $e1.metadata.description = /unauthorized.*admin/i
      or $e1.metadata.description = /output.*encod.*error/i
      or $e1.metadata.description = /escape.*fail/i
      or ($e1.network.http.response_code = 401 and $e1.network.http.request_url = /\/dataservice\//)
      or ($e1.network.http.response_code = 403 and $e1.network.http.request_url = /\/dataservice\//)
    )

  match:
    $e1.target.hostname over 10m

  outcome:
    $risk_score = max(85)
    $target_host = $e1.target.hostname
    $product = $e1.metadata.product_name

  condition:
    #e1 >= 2
}
critical severity medium confidence

Chronicle YARA-L rule detecting multiple CVE-2026-20245 exploitation indicators on Cisco SD-WAN Manager hosts — privilege escalation messages, encoding errors, and repeated API auth failures — within a 10-minute window.

Data Sources

Chronicle UDMCisco SD-WAN Manager logs ingested via forwarder

Required Tables

UDM Events

False Positives & Tuning

  • Legitimate SD-WAN Manager administrative configuration tasks generating privilege-related events
  • Automated orchestration platforms triggering multiple API authentication attempts
  • SD-WAN Manager diagnostic or telemetry processes producing encoding-related log output
  • Authorized red team or penetration testing activities against SD-WAN infrastructure

Other platforms for CVE-2026-20245

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1SD-WAN Manager REST API Endpoint Enumeration and Auth Probe

    Expected signal: Web server access logs and SD-WAN Manager audit logs should record multiple 401/403 responses to /dataservice/ endpoints from the probe source IP within a short time window

  2. Test 2Simulate Output Encoding Bypass via Crafted API Payload

    Expected signal: SD-WAN Manager application logs should record the API request with the encoded payload; web access logs capture the POST to /dataservice/users with unexpected encoded characters in request body

  3. Test 3Post-Exploitation Privilege Escalation Simulation via vManage Admin API

    Expected signal: SD-WAN Manager audit logs should record the group membership change attempt; if successful, an entry will appear under Administration > Audit Log showing the privilege modification with source IP and timestamp

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify all Cisco Catalyst SD-WAN Manager instances in the environment — confirm software versions and patch status against the Cisco advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx
  2. Review SD-WAN Manager audit logs (Administration > Audit Log) for unexpected privilege changes, new admin account creation, or API calls originating from unfamiliar source IPs within the last 72 hours
  3. Correlate alert source IPs against threat intelligence feeds and known management IP allowlists — flag any external or unexpected source IPs that accessed /dataservice/ REST endpoints
  4. Check for unauthorized user accounts or role modifications in SD-WAN Manager (Administration > Manage Users) that may indicate post-exploitation privilege persistence

Containment

  1. If active exploitation is confirmed, immediately restrict access to the SD-WAN Manager management plane — enforce IP allowlisting on the management interface and block external access at the perimeter firewall until the patch is applied
  2. Rotate all SD-WAN Manager administrative credentials and invalidate active sessions; revoke and reissue API tokens for any automated integrations accessing the management API

Evidence Collection

  1. Export full SD-WAN Manager audit logs (Administration > Audit Log) covering the period 72 hours before the first alert through present — preserve as tamper-evident archive
  2. Capture SD-WAN Manager application logs from /var/log/nms/ on the vManage host, including nm_server.log, vdaemon.log, and any core dump files generated around the time of suspicious activity

Escalation Criteria

  • !Escalate immediately if any new administrative accounts were created or existing admin privileges were elevated without a corresponding change-management ticket — this indicates likely successful exploitation
  • !Escalate if SD-WAN Manager has been used to push unauthorized configuration changes to managed SD-WAN edge devices, as this would indicate lateral movement from the management plane to the data plane

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >SD-WAN Manager audit log entries (Administration > Audit Log) showing privilege changes, user creation, or unusual API activity
  • >Web server access logs showing repeated 401/403 responses to /dataservice/ REST endpoints from unexpected source IPs, followed by successful 200 responses indicating successful bypass
  • >vManage application logs in /var/log/nms/ containing Java exceptions, encoding errors, or stack traces that correlate with exploitation timing

Tuning Guidance

Reduce false positives by building and maintaining a dynamic allowlist of known management IP addresses (NOC, SIEM, orchestration platforms) and excluding these from alerting. Set the failure threshold (currently >= 2 events) higher (>= 5) in environments with noisy automated tooling. If the SD-WAN Manager REST API is heavily used by automation, filter on source IPs not in the known automation inventory. For the CrowdStrike rule, exclude known software update processes and Cisco-signed binaries from shell spawn detection. Tune upward to high confidence once the environment's baseline API error rate is established.

Hunting Queries

Hunts for the authentication bypass pattern associated with output encoding exploitation — source IPs that first received repeated 4xx errors on SD-WAN Manager API endpoints and then subsequently received 200 OK responses, suggesting a successful bypass after initial failures

Hunting — KQL
kql 
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where DeviceVendor == "Cisco" and DeviceProduct has_any ("SD-WAN", "vManage")
| where RequestURL has "/dataservice/"
| where EventOutcome in ("403", "401", "500")
| summarize FailureCount = count(), UniqueURLs = dcount(RequestURL), FirstFailure = min(TimeGenerated), LastFailure = max(TimeGenerated) by SourceIP, DestinationIP
| where FailureCount >= 5
| join kind=inner (
    CommonSecurityLog
    | where TimeGenerated >= ago(7d)
    | where DeviceVendor == "Cisco" and DeviceProduct has_any ("SD-WAN", "vManage")
    | where RequestURL has "/dataservice/"
    | where EventOutcome == "200"
    | summarize SuccessCount = count() by SourceIP
) on SourceIP
| project FirstFailure, LastFailure, SourceIP, DestinationIP, FailureCount, SuccessCount, UniqueURLs
| order by FailureCount desc
Hunting — SPL
spl 
index=network_security sourcetype="cisco:sdwan" "/dataservice/"
| stats count(eval(status>=400)) as failures, count(eval(status=200)) as successes by src_ip, dest_ip
| where failures >= 5 AND successes >= 1
| eval failure_then_success="Possible auth bypass — investigate"
| table src_ip, dest_ip, failures, successes, failure_then_success

Atomic Red Team Tests

Test 1 SD-WAN Manager REST API Endpoint Enumeration and Auth Probe
linux

Simulates initial reconnaissance and authentication probing against a Cisco Catalyst SD-WAN Manager REST API, consistent with early-stage CVE-2026-20245 exploitation. Tests detection of repeated 401/403 responses on /dataservice/ endpoints from an unexpected source.

Command

bash 
TARGET_IP="192.168.100.10"; TARGET_PORT="8443";
for endpoint in "/dataservice/client/token" "/dataservice/users" "/dataservice/admin/user" "/dataservice/system/information"; do
  echo "[*] Probing: https://${TARGET_IP}:${TARGET_PORT}${endpoint}";
  curl -sk -o /dev/null -w "%{http_code} %{url_effective}\n" \
    -H 'Content-Type: application/json' \
    -H 'X-XSRF-TOKEN: ' \
    "https://${TARGET_IP}:${TARGET_PORT}${endpoint}";
  sleep 1;
done

Cleanup

bash 
No cleanup required — read-only HTTP probes against lab target only

Expected Telemetry

Web server access logs and SD-WAN Manager audit logs should record multiple 401/403 responses to /dataservice/ endpoints from the probe source IP within a short time window

Expected Detection

KQL, SPL, and QRadar queries should fire on repeated API authentication failures from the probe source IP against SD-WAN Manager endpoints

Test 2 Simulate Output Encoding Bypass via Crafted API Payload
linux

Sends a crafted HTTP request to the SD-WAN Manager REST API with specially encoded characters in parameter values to test for CWE-116 output encoding deficiencies. Lab environment only against an unpatched vManage instance.

Command

bash 
TARGET_IP="192.168.100.10"; TARGET_PORT="8443";
TOKEN=$(curl -sk -X POST "https://${TARGET_IP}:${TARGET_PORT}/dataservice/client/token" \
  -H 'Content-Type: application/json' \
  -d '{"j_username":"admin","j_password":"admin"}' | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('token',''))" 2>/dev/null);
echo "[*] Attempting crafted payload with encoded characters";
curl -sk -X POST "https://${TARGET_IP}:${TARGET_PORT}/dataservice/users" \
  -H 'Content-Type: application/json' \
  -H "X-XSRF-TOKEN: ${TOKEN}" \
  -d '{"userName":"test%00admin","password":"Test@1234","group":["basic"],"description":"test%3Bescaped"}' \
  -w "\nHTTP Status: %{http_code}\n"

Cleanup

bash 
Log in to SD-WAN Manager admin console and remove any test user accounts created during the test; review audit log to confirm no unintended privilege changes occurred

Expected Telemetry

SD-WAN Manager application logs should record the API request with the encoded payload; web access logs capture the POST to /dataservice/users with unexpected encoded characters in request body

Expected Detection

Log-based detections should capture the API call; if the encoded payload bypasses validation and creates a user, audit log detections should fire on unexpected user creation event

Test 3 Post-Exploitation Privilege Escalation Simulation via vManage Admin API
linux

Simulates post-exploitation privilege escalation by attempting to modify an existing low-privilege user account to add admin group membership via the SD-WAN Manager REST API, consistent with CVE-2026-20245 privilege escalation impact.

Command

bash 
TARGET_IP="192.168.100.10"; TARGET_PORT="8443"; LOW_PRIV_USER="testoperator";
TOKEN=$(curl -sk -X POST "https://${TARGET_IP}:${TARGET_PORT}/dataservice/client/token" \
  -H 'Content-Type: application/json' \
  -d '{"j_username":"testoperator","j_password":"Operator@1234"}' | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('token',''))" 2>/dev/null);
echo "[*] Attempting privilege escalation via group membership change";
curl -sk -X PUT "https://${TARGET_IP}:${TARGET_PORT}/dataservice/admin/user/${LOW_PRIV_USER}/group" \
  -H 'Content-Type: application/json' \
  -H "X-XSRF-TOKEN: ${TOKEN}" \
  -d '["netadmin"]' \
  -w "\nHTTP Status: %{http_code}\n";
echo "[*] Checking current group membership";
curl -sk "https://${TARGET_IP}:${TARGET_PORT}/dataservice/admin/user/${LOW_PRIV_USER}" \
  -H "X-XSRF-TOKEN: ${TOKEN}" | python3 -m json.tool 2>/dev/null

Cleanup

bash 
Restore the test user account to its original low-privilege group membership via SD-WAN Manager admin console; verify no persistent backdoor accounts were created

Expected Telemetry

SD-WAN Manager audit logs should record the group membership change attempt; if successful, an entry will appear under Administration > Audit Log showing the privilege modification with source IP and timestamp

Expected Detection

Playbook escalation criteria should trigger — any successful privilege elevation not matching a change-management ticket warrants immediate escalation; SIEM detections on SD-WAN Manager audit log ingestion should alert on group membership changes

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0001Initial AccessTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1068Exploitation for Privilege EscalationT1078Valid Accounts

Same Tactic: Privilege Escalation

Popular Detections