CVE-2026-20127/20182 Cisco SD-WAN vManage Auth Bypass — UAT-8616 Initial Access
Monitors Cisco SD-WAN (vManage, vBond, vSmart) appliance logs for authentication events against management accounts. It specifically identifies logins from known malicious IP addresses associated with threat actor activities and flags anomalous authentication methods such as PAM/keyboard-interactive and unvalidated administrative access.
Splunk (SPL)
