June 9, 2026 · Security-Advisory · Cisco

Cisco SD-WAN Under Fire: Zero-Day Wave by UAT-8616

For months, zero-days in Cisco Catalyst SD-WAN Manager and Controller have been actively exploited. What operators should patch and check now.

Since early 2026, an attack wave has been underway against Cisco Catalyst SD-WAN Manager (formerly vManage) and its associated Controller. Researchers at Cisco Talos attribute the activity to an as-yet unattributed actor tracked as UAT-8616. What is remarkable is less a single flaw than the series: by June 2026, roughly half a dozen SD-WAN zero-days had been actively exploited within a single year.

Two vulnerabilities are currently at the center. CVE-2026-20182, an authentication bypass, was reported to Cisco on March 9, 2026, and observed in attacks since around May 2026. CVE-2026-20245, a CLI injection with privilege escalation to root (CVSS 7.8 per Cisco), was already being actively exploited at the time of disclosure on June 4, 2026 – initially without an available patch. Add to this further advisories (CVE-2026-20127, -20128, -20122, -20133) as well as renewed exploitation of the older CVE-2022-20775. Several of these flaws are in CISA’s Known Exploited Vulnerabilities (KEV) catalog; for one, US federal agencies faced a deadline of just three days.

The attack chain described by Talos: initial access via unauthorized SD-WAN peering attempts, then chained authentication bypass and privilege escalation to root on the management plane. There, the attackers deposited their own SSH keys, altered the NETCONF configuration, and pushed changes out to connected edge devices. In some compromised clusters, cryptominers, infostealers, and web shells were also found.

Who is affected

Affected are all organizations that operate Cisco Catalyst SD-WAN Manager or Controller – regardless of whether the environment is self-managed or run by a service provider. Especially exposed are installations whose management plane is reachable from the internet or from weakly segmented partner networks. In the mid-market, SD-WAN was often introduced during site-interconnection projects; anyone who made the management components “pragmatically” reachable back then should revise that decision now. Since individual fixes appear staggered and no patch was initially available for CVE-2026-20245, merely waiting for updates is not enough.

What to do now

  • Patch as soon as a fix appears: The corrections come staggered per release branch. Monitor the Cisco advisories continuously and apply every available Fixed Release immediately.
  • Isolate the management plane: SD-WAN Manager and Controller must never be directly reachable from the internet. Access only from dedicated admin networks, ideally via jump hosts.
  • Where no patch exists, strictly limit access: Reduce reachability to the absolute minimum until a fix is available.
  • Check for compromise: Audit deposited SSH keys on Manager and Controller instances as well as the NETCONF configuration history for changes that cannot be accounted for – on the edge devices too.
  • Monitor peering: Alert on unauthorized SD-WAN peering attempts; in the observed campaign they were the initial access.
  • If suspected: Treat affected instances as compromised, rotate credentials and keys, and take a forensic image before rebuilding.

How sector7 helps

sector7 operates and hardens network and security infrastructure for the mid-market – owner-led and with vendor certifications for Juniper, Cisco, HPE, F5, Fortinet and Palo Alto Networks. Our 24/7 NOC monitoring detects suspicious peering attempts and configuration changes before they turn into an incident. We offer patch management and monitoring as a predictable managed service at flat monthly rates.

Sources

Let's talk about your situation.

Arrange a call+49 212 240915 0