Browse public community intelligence reports, source analysis, and threat research.
7 intel reports
An unauthenticated attacker can bypass authentication on Cisco SD-WAN vManage devices by utilizing URL-encoded paths and internal usernames to obtain admin-level sessions.
Cisco Catalyst SD-WAN Manager is vulnerable to a critical API authentication bypass (CVE-2026-76504) due to improper URI encoding handling, currently being exploited in the wild.
Sophisticated threat actor UAT-8616 and additional clusters are exploiting at least 12 vulnerabilities in Cisco SD-WAN, FMC, and ASA/FTD devices for persistent access and root escalation.
State-sponsored and crimeware actors are actively exploiting Cisco Secure Firewall Management Center vulnerabilities to deploy Cyclops Blink, Qilin ransomware, and custom web shells.
Sophisticated threat actor UAT-8616 is targeting Cisco Catalyst SD-WAN components using zero-day vulnerabilities to gain root access and manipulate network fabric configurations.
The EvilTokens and ARToken Phishing-as-a-Service (PhaaS) platforms use Microsoft Device Code flows and browser-side decryption to bypass MFA and achieve persistent Microsoft 365 account takeovers.
A critical authentication bypass in Cisco Catalyst SD-WAN's vdaemon service allows unauthenticated attackers to gain control-plane access by impersonating a vHub device.
