The Internet Changes Before the Advisory Drops

Summary: GreyNoise sensors observed eight distinct surges of Cisco-targeting activity before Cisco published its advisory for CVE-2026-20127, a CVSS 10.0 zero-day cited in a Five Eyes joint warning, with the earliest arriving 39 days before disclosure. Over 103 days, GreyNoise tracked 147.8 million sessions across 276 vendor-specific tags covering 18 network infrastructure vendors, and of 104 detected surge events, 68 preceded a vendor-matched CVE spanning 33 vulnerabilities across 16 vendor families.
Key Takeaway: VulnCheck documented that 28.96% of KEVs in 2025 were exploited on or before publication day, so a process that starts with the advisory is already behind on nearly three in ten known exploited vulnerabilities.

Read the original at GreyNoise Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-20127
Related: CVE-2026-20127: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Feb 25, 2026
Threat Advisory: Pulse Secure Connect Coverage Cyber Risks ·
Print Nightmare: Here’s what you need to know and Talos’ coverage Cyber Risks ·