At The Edge Clear: October 26 – November 2, 2026
Summary: GreyNoise reported that Cisco SD-WAN Manager CVE-2026-76504 auth bypass attempts peaked at 20 malicious IPs in a single day with almost no discovery traffic first, a month after CISA's fix deadline had passed. Four days later, 24 malicious IPs attempted Citrix NetScaler command injection CVE-2017-6316 in a separate one-day burst, while three hosting ranges on three networks sent 90% of Sophos Firewall CVE-2022-1040 exploitation traffic and Cisco SSL VPN brute-force attempts peaked at 350 malicious IPs in a day, 1.9 times the 22 October peak.
What's compelling: Blocking any one of the three Sophos hosting ranges leaves at least two thirds of the exploitation traffic in place, and four hosting IPs carried 82% of the Cisco VPN credential attempts - so single-range or single-IP blocks leave most of the activity untouched.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2017-6316CVE-2022-1040CVE-2026-76504
- Related
- CVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability Known Exploited Vulnerabilities · Sep 30, 2026CVE-2022-1040: Sophos Firewall Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Mar 31, 2022CVE-2017-6316: Citrix Multiple Products Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Mar 25, 2022