Cisco SD-WAN CVE-2026-20127 auth bypass: SSH/NETCONF then KeyDrift file activity

ills3c Intel&Coffee@Ills3C

•updated yesterday•0•0•1

Detects an inbound SSH (port 22) or NETCONF (port 830) connection from a public IP source to a device, followed closely on the same device by KeyDrift staging file/folder activity associated with network controller components.