Browse public community intelligence reports, source analysis, and threat research.
5 intel reports
An unauthenticated attacker can bypass authentication on Cisco SD-WAN vManage devices by utilizing URL-encoded paths and internal usernames to obtain admin-level sessions.
Threat actor UAT-11473 exploited CVE-2026-20127 in Cisco Catalyst SD-WAN to deploy KeyDrift malware for harvesting AES-256 encryption keys.
Cisco Catalyst SD-WAN Manager is vulnerable to a critical API authentication bypass (CVE-2026-76504) due to improper URI encoding handling, currently being exploited in the wild.
Sophisticated threat actor UAT-8616 and additional clusters are exploiting at least 12 vulnerabilities in Cisco SD-WAN, FMC, and ASA/FTD devices for persistent access and root escalation.
Sophisticated threat actor UAT-8616 is targeting Cisco Catalyst SD-WAN components using zero-day vulnerabilities to gain root access and manipulate network fabric configurations.
