Active exploitation of Cisco Catalyst SD-WAN by UAT-8616
Summary: Cisco Talos is tracking active exploitation of CVE-2026-20127, an authentication bypass in Cisco Catalyst SD-WAN Controller (formerly vSmart) that lets an unauthenticated remote attacker send a crafted request and gain administrative privileges as a high-privileged, non-root internal user. Talos attributes the exploitation and post-compromise activity to UAT-8616, which it assesses with high confidence as a highly sophisticated threat actor, and found evidence the malicious activity dates back to at least 2023, with intelligence partners reporting the actor likely escalated to root via a software version downgrade and exploitation of CVE-2022-20775 before restoring the original version.
What's compelling: UAT-8616's activity went undetected for at least three years, and its path to root ran through a version downgrade and a second vulnerability (CVE-2022-20775) rather than the initial bypass alone - so patching CVE-2026-20127 without validating control connection peering events in your SD-WAN logs may leave the foothold in place.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2022-20775CVE-2026-20127
- Related
- Attackers exploiting zero-day vulnerability in Windows Installer — Here’s what you need to know and Talos’ coverage Cyber Risks ·Threat Advisory: Atlassian Confluence zero-day vulnerability under active exploitation Cyber Risks ·Inside Key Drift: Analyzing historical UAT-11473 activity on Cisco SD-WAN Cyber Risks · Oct 28, 2026