Zero-Day Exploitation of Cisco SD-WAN Infrastructure

A highly sophisticated threat actor, tracked as UAT-8616, has been targeting Cisco Catalyst SD-WAN infrastructure since at least 2023. Exploitation involves a sophisticated multi-stage attack chain targeting the SD-WAN Manager (vManage), Controller (vSmart), and Validator (vBond) components. Attackers initially gain access via unauthorized rogue peering connections or stolen certificates, likely leveraging authentication bypass vulnerabilities such as CVE-2026-20127 or CVE-2026-20182.

Once initial access is established, the actor utilizes the 'vmanage-admin' account to manipulate default passwords and exfiltrate network fabric configurations. A critical zero-day privilege escalation vulnerability, CVE-2026-20245, is then exploited via a malicious CSV file upload to gain root-level access. The threat actor demonstrates high operational security by employing extensive anti-forensic techniques, including log tampering, configuration restoration, and the use of validation scripts to verify the removal of indicators.

These attacks pose a severe risk as compromised SD-WAN management planes allow for the manipulation of network traffic, policy enforcement, and the insertion of malicious devices into the trusted fabric. Affected sectors include financial services, healthcare, and government facilities. Organizations are urged to prioritize patching, restrict management interface exposure, and conduct deep forensic audits for signs of unauthorized peering and credential manipulation.