Cisco SD-WAN SSH Persistence and Config Tampering

Ethan Andrews@eandrews

•updated Feb 25, 2026•23•1•229

Monitors for command-line activity indicating the addition of SSH keys to authorized_keys files or the modification of the SSH daemon configuration to permit root login on Cisco SD-WAN devices. This is a common persistence technique used by attackers after gaining initial access, such as through CVE-2026-20127.