Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities
Summary: Talos reports active in-the-wild exploitation of CVE-2026-20182 in Cisco Catalyst SD-WAN Controller and Manager, allowing login as an internal high-privileged non-root user, with post-compromise activity clustered under UAT-8616, which previously exploited CVE-2026-20127 and attempted to add SSH keys, modify NETCONF configurations, and escalate to root. Talos also reports widespread exploitation of CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122 in unpatched SD-WAN Manager infrastructure, chained to give a remote unauthenticated attacker access, with exploitation observed from March to April 2026 after ZeroZenX Labs released proof-of-concept code in March.
What's compelling: Ten separate clusters have been exploiting the chained SD-WAN Manager flaws since at least March 3, 2026, deploying webshells including XenShell, Godzilla, and Behinder variants, plus XMRig miners, the Sliver framework, and an AdaptixC2 agent - most using publicly available proof-of-concept code, which lowers the skill required to reach your edge devices.