InfoSecBulletin Cybersecurity for mankind
Cisco has issued urgent updates to fix a critical zero-day (CVE-2026-20127) vulnerability in its Catalyst SD-WAN products. A sophisticated threat actor named UAT-8616 is exploiting this flaw to gain deep access to enterprise networks.
An unauthenticated remote attacker can exploit this weakness by sending specific requests to a vulnerable system. Cisco Talos has linked these ongoing attacks to UAT-8616, an advanced cyber threat actor that has been active since at least 2023.
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
These attackers focus on edge network devices to gain lasting access to critical infrastructure organizations. After UAT-8616 gains initial access through the zero-day flaw, they employ a multi-step method to gain complete control.
Attackers first downgrade the device’s software to an older, vulnerable version. They exploit a secondary vulnerability, CVE-2022-20775, enabling local attackers to gain root-level privileges. They reverted the system to the original software version to cover their tracks and keep their root access hidden.
Affected Products:
This vulnerability affects Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager, regardless of device configuration.
This vulnerability affects the following deployment types:
On-Prem Deployment
Cisco Hosted SD-WAN Cloud
Cisco Hosted SD-WAN Cloud – Cisco Managed
Cisco Hosted SD-WAN Cloud – FedRAMP Environment
Indicators of Compromise:
Cisco Catalyst SD-WAN Controller systems that are exposed to the internet and that have ports exposed to the internet are at risk of exposure to compromise.
Customers are encouraged to audit the auth.log file, located at /var/log/auth.log, for entries that are related to Accepted publickey for vmanage-admin from unknown or unauthorized IP addresses, as shown in the following example:
2026-02-10T22:51:36+00:00 vm sshd[804]: Accepted publickey for vmanage-admin from port [REDACTED PORT] ssh2: RSA SHA256:[REDACTED KEY]
Customers must check the IP address in the auth.log log file against the configured System IPs that are listed in the Cisco Catalyst SD-WAN Manager web UI in the WebUI > Devices > System IP column.
Cisco said customers should open a case with the Cisco Technical Assistance Center (TAC). Before opening a new TAC case, customers are encouraged to issue the request admin-tech command from each of the control components in the SD-WAN deployment so that the admin-tech file can be provided to the Cisco TAC for review.
