Unauthorized SSH Key Injection Into vmanage-admin authorized_keys
Detects modifications to /home/vmanage-admin/.ssh/authorized_keys on Cisco SD-WAN controllers (vSmart, vManage, vBond) by any process. This file is a post-exploitation persistence target documented by Resecurity and Rapid7 for CVE-2026-20182. Legitimate modifications to this file are extremely rare in production SD-WAN deployments, as the vmanage-admin account is an internal service account and its authorized_keys file is provisioned during initial deployment and rarely touched afterward. Any write event is worth immediate investigation.
Cortex XDR
