Cisco SD-WAN vmanage-admin SSH Accepted

Daniel Jeremiah@daniyyell

•updated Feb 28, 2026•1•0•42

This rule detects successful SSH logins for the 'vmanage-admin' user, specifically when publickey authentication is used. This pattern is highlighted as a potential indicator of compromise, especially in the context of Cisco Catalyst SD-WAN systems and related vulnerabilities like CVE-2026-20127. The rule aims to flag highly privileged administrative access for review, prompting verification of the source IP address against authorized locations and expected maintenance windows. Unexplained access should be treated as suspicious.