UAT-8616 SSH Authorized Key Manipulation on Cisco SD-WAN vManage

Ethan Andrews@eandrews

•updated Jun 25, 2026•1•0•3

Detects unauthorized modifications to SSH authorized_keys files and changes to SSH configuration (specifically PermitRootLogin) on Cisco SD-WAN controllers, which may indicate persistence or unauthorized remote access attempts.