UAT-8616 Cisco SD-WAN Rogue Peer Injection via CVE-2026-20127/CVE-2026-20182

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

This rule detects network communication targeting specific external IP addresses associated with known SD-WAN infrastructure and common management endpoints (e.g., /dataservice/). This behavior may indicate an attempt to interact with, enumerate, or compromise SD-WAN controllers or managed edge devices.