{"vulnerability": "CVE-2026-20122", "sightings": [{"uuid": "8fc61ce9-a622-449a-b6be-a250d2b793fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://bsky.app/profile/rankednews.bsky.social/post/3mgh5z6lbpj2g", "content": "", "creation_timestamp": "2026-03-07T06:08:07.923608Z"}, {"uuid": "108969f7-6144-4fcb-af81-e15d6e16adcf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://gist.github.com/alon710/ea2f297d04de8823aedd27e12502bd5b", "content": "", "creation_timestamp": "2026-03-05T10:40:06.000000Z"}, {"uuid": "0eee611f-806a-4387-a754-96f0237933f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mgfcv6epdc23", "content": "", "creation_timestamp": "2026-03-06T12:30:03.514800Z"}, {"uuid": "258bc18a-5a1f-433b-a4bf-de86e52bd1a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://www.cert.at/de/warnungen/2026/2/kritische-sicherheitslucken-in-cisco-catalyst-sd-wan-aktiv-ausgenutzt-updates-verfugbar", "content": "", "creation_timestamp": "2026-02-26T11:58:53.000000Z"}, {"uuid": "d5f2d330-2239-4596-823c-ef8bf03fe60e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://infosec.exchange/users/edwardk/statuses/116176479912988309", "content": "", "creation_timestamp": "2026-03-05T12:06:41.408139Z"}, {"uuid": "c4a5e899-e265-4eb3-944c-36cf96faead6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mgcr5jawyk2x", "content": "", "creation_timestamp": "2026-03-05T12:07:17.611365Z"}, {"uuid": "b6996ef4-ab4d-4746-8152-aff8f9fbf7ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0071", "content": "", "creation_timestamp": "2026-03-06T11:07:02.000000Z"}, {"uuid": "79c30084-0272-46be-b52f-0e114c840fc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mgik6iv3ac23", "content": "", "creation_timestamp": "2026-03-07T19:18:31.651650Z"}, {"uuid": "d25150ee-df7b-4e6f-9c0d-766765db12d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://bsky.app/profile/hack4career.com/post/3mgfjdl24bc25", "content": "", "creation_timestamp": "2026-03-06T14:25:27.962008Z"}, {"uuid": "7d0c895e-569b-411b-a56e-32e2a2b77b75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mgepk4y3yk2h", "content": "", "creation_timestamp": "2026-03-06T06:43:54.098954Z"}, {"uuid": "acea0afb-a562-4488-9b64-81f9a8b03611", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://bsky.app/profile/cloud-native.activitypub.awakari.com.ap.brid.gy/post/3mgeqkzerw552", "content": "", "creation_timestamp": "2026-03-06T07:02:45.771570Z"}, {"uuid": "cd7bced2-398a-4cc8-a5c1-1a8b5a6322b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://threatintel.cc/2026/03/05/cisco-flags-more-sdwan-flaws.html", "content": "", "creation_timestamp": "2026-03-05T11:06:47.000000Z"}, {"uuid": "80b58b90-971a-4dc8-aa7c-bba53c7894fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mgft3sath72m", "content": "", "creation_timestamp": "2026-03-06T17:20:05.072353Z"}, {"uuid": "c878a8b1-df75-4850-87cf-9f60a6a6f72f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://bsky.app/profile/sctocs.bsky.social/post/3mgfvn535zs2t", "content": "", "creation_timestamp": "2026-03-06T18:05:42.888312Z"}, {"uuid": "3735d6d4-b8bd-4062-8682-1f16f1cb3d95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-20122", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mgd6bnngwt2p", "content": "", "creation_timestamp": "2026-03-05T16:02:12.912469Z"}, {"uuid": "89be8fa8-dc05-4a53-9d31-e23acef04d3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://bsky.app/profile/solidot.bsky.social/post/3mgd7vksqzs2o", "content": "", "creation_timestamp": "2026-03-05T16:31:14.782901Z"}, {"uuid": "1890635e-111d-486f-9bb2-8cd62223daf2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://thehackernews.com/2026/03/cisco-confirms-active-exploitation-of.html", "content": "", "creation_timestamp": "2026-03-05T14:22:00.000000Z"}, {"uuid": "1b61fd5a-b14e-4052-88b3-dd83b2487bd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mgg7kcqicj2h", "content": "", "creation_timestamp": "2026-03-06T21:02:59.812803Z"}, {"uuid": "c31c6702-0461-4ee8-ba16-7ff6410ad10d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://bsky.app/profile/firstpasslab.bsky.social/post/3mgdfudtaec2t", "content": "", "creation_timestamp": "2026-03-05T18:17:57.098340Z"}, {"uuid": "7c5ba8fd-5d86-4570-a6f5-af3bf30c2f4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mfp5rtagrx26", "content": "", "creation_timestamp": "2026-02-25T17:00:08.369853Z"}, {"uuid": "a022eb9f-8516-4c07-b56b-a89cc11b9a21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/116250849364616830", "content": "", "creation_timestamp": "2026-03-18T15:19:49.349919Z"}, {"uuid": "a7a21a87-c6d7-4d93-9a1d-a9cfa893567f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rilevato-sfruttamento-di-vulnerabilita-in-prodotti-cisco", "content": "", "creation_timestamp": "2026-02-25T17:29:05.000000Z"}, {"uuid": "581065aa-871b-46b6-adf9-fa91db2706ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/kriittisia-haavoittuvuuksia-cisco-catalyst-sd-wan-tuotteissa", "content": "", "creation_timestamp": "2026-02-25T18:43:06.000000Z"}, {"uuid": "9d703255-c9c9-467f-ab28-c35e31834e60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-166", "content": "", "creation_timestamp": "2026-02-25T20:03:01.000000Z"}, {"uuid": "9b257bc3-d1be-4a7d-b43b-ce1e399b1ea7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-010/", "content": "", "creation_timestamp": "2026-03-09T00:00:00.000000Z"}, {"uuid": "cfd74578-00a0-4196-b53a-59cd64de7168", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/b24f0b20-207c-4881-af91-eb1d15b224ba", "content": "", "creation_timestamp": "2026-02-25T16:34:22.000000Z"}, {"uuid": "1a5b7bcd-3d4b-4e9d-85b9-ab2f2634a973", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://www.cert.si/si-cert-2026-01/", "content": "", "creation_timestamp": "2026-02-25T19:26:43.000000Z"}, {"uuid": "96ae4485-72e8-431b-9941-ba0956621143", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://www.cert.se/2026/02/kritisk-nolldagssarbarhet-i-cisco-catalyst-sd-wan.html", "content": "", "creation_timestamp": "2026-02-26T07:45:00.000000Z"}, {"uuid": "f01a7f8e-23dd-454c-b8c4-69b362bb053a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://www.ncsc.nl/alerts/actief-misbruik-van-kwetsbaarheden-in-cisco-producten", "content": "", "creation_timestamp": "2026-03-06T15:20:00.000000Z"}, {"uuid": "a9416e73-cdd9-4715-9bbe-351c312a7870", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2026-20122", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e1228312-271a-42cb-9474-847cdc1a1e8e", "content": "", "creation_timestamp": "2026-04-20T20:00:03.021667Z"}, {"uuid": "0204c685-e23c-48c7-b674-6813e4cadf8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://bsky.app/profile/pigondrugs.bsky.social/post/3mjy3x67srm2n", "content": "", "creation_timestamp": "2026-04-21T04:02:04.244374Z"}, {"uuid": "a5d29e0e-e13b-4485-a9d4-8143657cd31f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://ccb.belgium.be/advisories/warning-multiple-critical-vulnerabilities-several-cisco-products-including-cisco-secure", "content": "", "creation_timestamp": "2026-04-21T06:56:53.000000Z"}, {"uuid": "c2e5aefa-7e6e-4015-9f38-63c9219547c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/116449675412278045", "content": "", "creation_timestamp": "2026-04-22T18:03:54.189185Z"}, {"uuid": "02ad3b53-f7db-44e9-9140-eda040245746", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "exploited", "source": "https://t.me/true_secator/7969", "content": "Cisco \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u043e \u043d\u0430\u0447\u0430\u043b\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u0432\u043e\u043b\u043d\u044b \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0434\u0432\u0443\u0445 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Catalyst SD-WAN \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445.\n\n25 \u0444\u0435\u0432\u0440\u0430\u043b\u044f \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a \u0443\u0432\u0435\u0434\u043e\u043c\u0438\u043b \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u0434\u043b\u044f\u00a0\u043f\u044f\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Catalyst SD-WAN, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c \u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0434\u043e \u0443\u0440\u043e\u0432\u043d\u044f root.\u00a0\n\n\u041f\u043e \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044e \u043d\u0430 5 \u043c\u0430\u0440\u0442\u0430 Cisco \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0430 \u0441\u0432\u043e\u0435 \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0435 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0435, \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u0432 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0435\u0439 \u0441\u0442\u0430\u043b\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043e\u0431 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0434\u0432\u0443\u0445 \u0438\u0437 \u043f\u044f\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2026-20128 \u0438 CVE-2026-20122.\n\n\u041f\u0435\u0440\u0432\u0430\u044f, CVE-2026-20128, - \u044d\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0444\u0443\u043d\u043a\u0446\u0438\u044e \u0430\u0433\u0435\u043d\u0442\u0430 \u0441\u0431\u043e\u0440\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 (DCA) \u0432 Catalyst SD-WAN Manager. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f DCA \u0432 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\n\u0414\u0440\u0443\u0433\u0430\u044f, CVE-2026-20122, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u044d\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0443\u044e API Catalyst SD-WAN Manager. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438.\n\n\u0412 Cisco \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0435\u0439 \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u044d\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043d\u043e \u0432 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0438 \u0443\u043a\u0430\u0437\u0430\u043d\u043e, \u0447\u0442\u043e \u043e\u043d\u0438 \u0431\u044b\u043b\u0438 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0435\u043d\u044b \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438.\n\n\u041d\u043e \u0441\u0442\u043e\u0438\u0442 \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0441\u0442\u0430\u0442\u0443\u0441\u0430 \u043f\u0440\u043e\u0438\u0437\u043e\u0448\u043b\u043e \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0447\u0435\u0440\u0435\u0437 \u043d\u0435\u0434\u0435\u043b\u044e \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a Cisco \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439\u00a00-day, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 Catalyst SD-WAN.\n\nCVE-2026-20127 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.\n\n\u0422\u043e\u0433\u0434\u0430 CISA \u0441\u043e\u043e\u0431\u0449\u0430\u043b\u0430, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u043b\u0430\u0441\u044c \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u0441 \u0431\u043e\u043b\u0435\u0435 \u0441\u0442\u0430\u0440\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e Catalyst, CVE-2022-20775, \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u0432 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\nCisco Talos \u0441\u0432\u044f\u0437\u0430\u043b\u0430 \u044d\u0442\u0438 \u0430\u0442\u0430\u043a\u0438 \u0441 UAT-8616, \u043f\u0440\u043e\u0434\u0432\u0438\u043d\u0443\u0442\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u043c \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 2023 \u0433\u043e\u0434\u0430.\u00a0\u041d\u043e \u043d\u0435\u044f\u0441\u043d\u043e, \u0431\u044b\u043b\u0438 \u043b\u0438 \u0432\u0441\u0435 \u044d\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Catalyst SD-WAN \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0432 \u043e\u0434\u043d\u043e\u0439 \u0438\u043b\u0438 \u0440\u0430\u0437\u043d\u044b\u0445 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f\u0445.\u00a0\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, Cisco \u0442\u0430\u043a\u0436\u0435 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u043b\u0430 \u0430\u0442\u0430\u043a\u0438 \u0441 \u043d\u0443\u043b\u044f\u043c\u0438,\u00a0\u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u044b\u043c\u0438 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 APT, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u043a\u0430\u043a UAT-9686. \u0412 \u043e\u0431\u0449\u0435\u043c, \u0431\u0443\u0434\u0435\u043c \u0441\u043b\u0435\u0434\u0438\u0442\u044c.", "creation_timestamp": "2026-03-05T17:00:08.000000Z"}, {"uuid": "d8005c7f-8d53-4ff8-bd7b-bd3fbbdf486b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "exploited", "source": "https://t.me/thehackernews/8543", "content": "\u26a0\ufe0f Cisco confirms active exploitation of two Catalyst SD-WAN Manager flaws.\n\n\u25b6 CVE-2026-20122 enables arbitrary file overwrite via API credentials.\n\u25b6CVE-2026-20128 can expose data and grant DCA privileges after login.\n\n\ud83d\udd17 Read \u2192 https://thehackernews.com/2026/03/cisco-confirms-active-exploitation-of.html\n\nPatches are out across multiple releases.", "creation_timestamp": "2026-03-05T15:23:45.000000Z"}, {"uuid": "d84a2349-c19b-4104-9030-41601346e375", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "exploited", "source": "https://t.me/cKure/16043", "content": "\u25a0\u25a0\u25a1\u25a1\u25a1 \u26a0\ufe0f Cisco confirms active exploitation of two Catalyst SD-WAN Manager flaws.\n\n\u25b6 CVE-2026-20122 enables arbitrary file overwrite via API credentials.\n\u25b6CVE-2026-20128 can expose data and grant DCA privileges after login.\n https://thehackernews.com/2026/03/cisco-confirms-active-exploitation-of.html", "creation_timestamp": "2026-03-05T20:45:14.000000Z"}, {"uuid": "7f10881e-01d3-4578-a9aa-db35ddae41c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mkevo53epc2s", "content": "", "creation_timestamp": "2026-04-26T06:14:16.729594Z"}, {"uuid": "1354ed90-efdb-40b1-ab71-45fca3d5504f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-012-critical-vulnerability-affecting-cisco-catalyst-sd-wan-cve-2026-20182", "content": "", "creation_timestamp": "2026-05-15T06:03:19.000000Z"}, {"uuid": "079eb171-9934-4030-8880-934721e43d89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mnplrje4632q", "content": "Cisco's Catalyst SD-WAN Manager faces active exploits of CVE-2026-20122 & CVE-2026-20128. Update systems now to protect your network. #CyberSecurity #Cisco #SDWAN #NetworkSecurity Link: thedailytechfeed.com/active-explo...", "creation_timestamp": "2026-06-07T16:32:02.095352Z"}, {"uuid": "6b375ab6-75db-4e9f-a620-236196d7eb88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://t.me/VulnerabilityNews/42060", "content": "CISA Adds Eight Known Exploited Vulnerabilities to Catalog\n\nCISA has added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\u00a0\nCVE-2023-27351 PaperCut NG/MF Improper Authentication Vulnerability\nCVE-2024-27199 JetBrains TeamCity Relative Path Traversal Vulnerability\nCVE-2025-2749 Kentico Xperience Path Traversal Vulnerability\nCVE-2025-32975 Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability\nCVE-2025-48700 Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability\nCVE-2026-20122 Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability\nCVE-2026-20128 Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability\nCVE-2026-20133 Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.\u00a0\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.\u00a0\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nhttps://www.cisa.gov/news-events/alerts/2026/04/20/cisa-adds-eight-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-08-18T19:00:04.619259Z"}, {"uuid": "79cf7818-d583-42df-867b-8a7afba4b8da", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/36939b49-5117-413e-985b-6903ccbe68ae", "content": "", "creation_timestamp": "2026-06-19T12:45:13.167723Z"}, {"uuid": "61f079dd-4070-4812-a545-1230cecd8c7b", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a432a19c-49e5-46bc-957f-64746d637ebb", "content": "", "creation_timestamp": "2026-06-23T14:03:39.525625Z"}, {"uuid": "a4a5a651-cba9-4896-b52b-895c8dd9c749", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "exploited", "source": "https://t.me/VulnerabilityNews/42060", "content": "CISA Adds Eight Known Exploited Vulnerabilities to Catalog\n\nCISA has added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\u00a0\nCVE-2023-27351 PaperCut NG/MF Improper Authentication Vulnerability\nCVE-2024-27199 JetBrains TeamCity Relative Path Traversal Vulnerability\nCVE-2025-2749 Kentico Xperience Path Traversal Vulnerability\nCVE-2025-32975 Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability\nCVE-2025-48700 Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability\nCVE-2026-20122 Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability\nCVE-2026-20128 Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability\nCVE-2026-20133 Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.\u00a0\nBinding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.\u00a0\nAlthough BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\nhttps://www.cisa.gov/news-events/alerts/2026/04/20/cisa-adds-eight-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-08-19T00:00:09.569020Z"}, {"uuid": "1b9b8516-fc20-4a27-b0eb-0e42df0bef60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://t.me/cissp/7871", "content": "When Network Infrastructure Becomes \nthe Initial Access Vector\n\nOver the past weeks, several critical vulnerabilities and active exploitations have surfaced across major enterprise infrastructure platforms highlighting once again that security perimeters are increasingly defined by mismanaged infrastructure components.\n\nHere are a few developments worth paying attention to:\n\n1. Cisco Catalyst SD-WAN Controllers (CVSS 10.0)\n\nCisco warned of active exploitation of CVE-2026-20127, allowing unauthenticated attackers to bypass authentication and gain administrative access. Researchers linked the activity to the UAT-8616 threat cluster, with indicators suggesting malicious control-plane peers and privilege escalation to root.\n\nImpact:\nCompromise of SD-WAN controllers effectively means control over the enterprise network fabric.\n\n2. Microsoft MSHTML Zero-Day (CVE-2026-21513)\n\nMicrosoft patched a vulnerability in ieframe.dll enabling attackers to bypass Mark of the Web protections and Internet Explorer ESC. A malicious LNK sample linked to APT28 infrastructure demonstrates how legacy components continue to provide viable entry points.\n\nImpact:\nMalicious documents can trigger code execution paths in environments that still rely on MSHTML rendering components.\n\n\n3. Additional Cisco SD-WAN Manager Exploits\n\nCisco confirmed exploitation of two additional flaws:\n\u2022 CVE-2026-20122 \u2013 arbitrary file overwrite using API credentials\n\u2022 CVE-2026-20128 \u2013 post login data exposure and privilege escalation (DCA)\n\nImpact:\nThese flaws demonstrate how API surfaces and management planes remain high-value attack targets.\n\n4. FortiGate as an Initial Breach Vector\n\nA recent SentinelOne investigation shows attackers abusing FortiGate devices to extract configuration files containing Active Directory service account credentials\nOnce obtained, adversaries:\n\u2022 Register rogue machines\n\u2022 Move laterally inside the network\n\u2022 Conduct internal reconnaissance\n\nImpact:\nSecurity appliances themselves are increasingly becoming the first compromised asset in breach chains.\n\nKey Takeaway\nThe pattern across these incidents is clear:\nInfrastructure security \u2260 device hardening alone.\n\nOrganizations need:\n\u2022 Continuous patch governance\ud83e\udd19\ud83c\udffe\n\u2022 Management plane isolation\n\u2022 Credential hygiene in network appliances\n\u2022 Detection capabilities focused on control plane anomalies\n\u2022 SOC playbooks covering network infrastructure compromise\ud83e\udd19\ud83c\udffe\n\nIn many breaches today, the firewall, SD-WAN controller, or edge appliance becomes the attacker\u2019s first domain controller.\n\n\u2014 CISO as a Service \u2014\nStrategic Cyber Defense & GRC\nResilient Through Knowledge\n2026.03.12\n\n#CyberSecurity #ThreatIntelligence #SDWAN #Fortinet #CiscoSecurity #ZeroDay #APT28 #SecurityGovernance #SOC #vCISO\n\nhttps://www.linkedin.com/posts/alirezaghahrood_cybersecurity-threatintelligence-sdwan-share-7437860289229910017-U23V", "creation_timestamp": "2026-09-01T17:00:12.650293Z"}, {"uuid": "659379ba-afa0-41ad-80cd-43e4fa98ff50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://t.me/cissp/7871", "content": "When Network Infrastructure Becomes \nthe Initial Access Vector\n\nOver the past weeks, several critical vulnerabilities and active exploitations have surfaced across major enterprise infrastructure platforms highlighting once again that security perimeters are increasingly defined by mismanaged infrastructure components.\n\nHere are a few developments worth paying attention to:\n\n1. Cisco Catalyst SD-WAN Controllers (CVSS 10.0)\n\nCisco warned of active exploitation of CVE-2026-20127, allowing unauthenticated attackers to bypass authentication and gain administrative access. Researchers linked the activity to the UAT-8616 threat cluster, with indicators suggesting malicious control-plane peers and privilege escalation to root.\n\nImpact:\nCompromise of SD-WAN controllers effectively means control over the enterprise network fabric.\n\n2. Microsoft MSHTML Zero-Day (CVE-2026-21513)\n\nMicrosoft patched a vulnerability in ieframe.dll enabling attackers to bypass Mark of the Web protections and Internet Explorer ESC. A malicious LNK sample linked to APT28 infrastructure demonstrates how legacy components continue to provide viable entry points.\n\nImpact:\nMalicious documents can trigger code execution paths in environments that still rely on MSHTML rendering components.\n\n\n3. Additional Cisco SD-WAN Manager Exploits\n\nCisco confirmed exploitation of two additional flaws:\n\u2022 CVE-2026-20122 \u2013 arbitrary file overwrite using API credentials\n\u2022 CVE-2026-20128 \u2013 post login data exposure and privilege escalation (DCA)\n\nImpact:\nThese flaws demonstrate how API surfaces and management planes remain high-value attack targets.\n\n4. FortiGate as an Initial Breach Vector\n\nA recent SentinelOne investigation shows attackers abusing FortiGate devices to extract configuration files containing Active Directory service account credentials\nOnce obtained, adversaries:\n\u2022 Register rogue machines\n\u2022 Move laterally inside the network\n\u2022 Conduct internal reconnaissance\n\nImpact:\nSecurity appliances themselves are increasingly becoming the first compromised asset in breach chains.\n\nKey Takeaway\nThe pattern across these incidents is clear:\nInfrastructure security \u2260 device hardening alone.\n\nOrganizations need:\n\u2022 Continuous patch governance\ud83e\udd19\ud83c\udffe\n\u2022 Management plane isolation\n\u2022 Credential hygiene in network appliances\n\u2022 Detection capabilities focused on control plane anomalies\n\u2022 SOC playbooks covering network infrastructure compromise\ud83e\udd19\ud83c\udffe\n\nIn many breaches today, the firewall, SD-WAN controller, or edge appliance becomes the attacker\u2019s first domain controller.\n\n\u2014 CISO as a Service \u2014\nStrategic Cyber Defense & GRC\nResilient Through Knowledge\n2026.03.12\n\n#CyberSecurity #ThreatIntelligence #SDWAN #Fortinet #CiscoSecurity #ZeroDay #APT28 #SecurityGovernance #SOC #vCISO\n\nhttps://www.linkedin.com/posts/alirezaghahrood_cybersecurity-threatintelligence-sdwan-share-7437860289229910017-U23V", "creation_timestamp": "2026-09-02T01:03:47.197243Z"}, {"uuid": "b5f565af-984c-42fa-a031-18f4f7974b15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://t.me/cissp/7871", "content": "When Network Infrastructure Becomes \nthe Initial Access Vector\n\nOver the past weeks, several critical vulnerabilities and active exploitations have surfaced across major enterprise infrastructure platforms highlighting once again that security perimeters are increasingly defined by mismanaged infrastructure components.\n\nHere are a few developments worth paying attention to:\n\n1. Cisco Catalyst SD-WAN Controllers (CVSS 10.0)\n\nCisco warned of active exploitation of CVE-2026-20127, allowing unauthenticated attackers to bypass authentication and gain administrative access. Researchers linked the activity to the UAT-8616 threat cluster, with indicators suggesting malicious control-plane peers and privilege escalation to root.\n\nImpact:\nCompromise of SD-WAN controllers effectively means control over the enterprise network fabric.\n\n2. Microsoft MSHTML Zero-Day (CVE-2026-21513)\n\nMicrosoft patched a vulnerability in ieframe.dll enabling attackers to bypass Mark of the Web protections and Internet Explorer ESC. A malicious LNK sample linked to APT28 infrastructure demonstrates how legacy components continue to provide viable entry points.\n\nImpact:\nMalicious documents can trigger code execution paths in environments that still rely on MSHTML rendering components.\n\n\n3. Additional Cisco SD-WAN Manager Exploits\n\nCisco confirmed exploitation of two additional flaws:\n\u2022 CVE-2026-20122 \u2013 arbitrary file overwrite using API credentials\n\u2022 CVE-2026-20128 \u2013 post login data exposure and privilege escalation (DCA)\n\nImpact:\nThese flaws demonstrate how API surfaces and management planes remain high-value attack targets.\n\n4. FortiGate as an Initial Breach Vector\n\nA recent SentinelOne investigation shows attackers abusing FortiGate devices to extract configuration files containing Active Directory service account credentials\nOnce obtained, adversaries:\n\u2022 Register rogue machines\n\u2022 Move laterally inside the network\n\u2022 Conduct internal reconnaissance\n\nImpact:\nSecurity appliances themselves are increasingly becoming the first compromised asset in breach chains.\n\nKey Takeaway\nThe pattern across these incidents is clear:\nInfrastructure security \u2260 device hardening alone.\n\nOrganizations need:\n\u2022 Continuous patch governance\ud83e\udd19\ud83c\udffe\n\u2022 Management plane isolation\n\u2022 Credential hygiene in network appliances\n\u2022 Detection capabilities focused on control plane anomalies\n\u2022 SOC playbooks covering network infrastructure compromise\ud83e\udd19\ud83c\udffe\n\nIn many breaches today, the firewall, SD-WAN controller, or edge appliance becomes the attacker\u2019s first domain controller.\n\n\u2014 CISO as a Service \u2014\nStrategic Cyber Defense & GRC\nResilient Through Knowledge\n2026.03.12\n\n#CyberSecurity #ThreatIntelligence #SDWAN #Fortinet #CiscoSecurity #ZeroDay #APT28 #SecurityGovernance #SOC #vCISO\n\nhttps://www.linkedin.com/posts/alirezaghahrood_cybersecurity-threatintelligence-sdwan-share-7437860289229910017-U23V", "creation_timestamp": "2026-09-09T03:00:07.151952Z"}, {"uuid": "6e67f581-2d06-4ea2-8040-bdff113484e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20122", "type": "seen", "source": "https://t.me/cissp/7871", "content": "When Network Infrastructure Becomes \nthe Initial Access Vector\n\nOver the past weeks, several critical vulnerabilities and active exploitations have surfaced across major enterprise infrastructure platforms highlighting once again that security perimeters are increasingly defined by mismanaged infrastructure components.\n\nHere are a few developments worth paying attention to:\n\n1. Cisco Catalyst SD-WAN Controllers (CVSS 10.0)\n\nCisco warned of active exploitation of CVE-2026-20127, allowing unauthenticated attackers to bypass authentication and gain administrative access. Researchers linked the activity to the UAT-8616 threat cluster, with indicators suggesting malicious control-plane peers and privilege escalation to root.\n\nImpact:\nCompromise of SD-WAN controllers effectively means control over the enterprise network fabric.\n\n2. Microsoft MSHTML Zero-Day (CVE-2026-21513)\n\nMicrosoft patched a vulnerability in ieframe.dll enabling attackers to bypass Mark of the Web protections and Internet Explorer ESC. A malicious LNK sample linked to APT28 infrastructure demonstrates how legacy components continue to provide viable entry points.\n\nImpact:\nMalicious documents can trigger code execution paths in environments that still rely on MSHTML rendering components.\n\n\n3. Additional Cisco SD-WAN Manager Exploits\n\nCisco confirmed exploitation of two additional flaws:\n\u2022 CVE-2026-20122 \u2013 arbitrary file overwrite using API credentials\n\u2022 CVE-2026-20128 \u2013 post login data exposure and privilege escalation (DCA)\n\nImpact:\nThese flaws demonstrate how API surfaces and management planes remain high-value attack targets.\n\n4. FortiGate as an Initial Breach Vector\n\nA recent SentinelOne investigation shows attackers abusing FortiGate devices to extract configuration files containing Active Directory service account credentials\nOnce obtained, adversaries:\n\u2022 Register rogue machines\n\u2022 Move laterally inside the network\n\u2022 Conduct internal reconnaissance\n\nImpact:\nSecurity appliances themselves are increasingly becoming the first compromised asset in breach chains.\n\nKey Takeaway\nThe pattern across these incidents is clear:\nInfrastructure security \u2260 device hardening alone.\n\nOrganizations need:\n\u2022 Continuous patch governance\ud83e\udd19\ud83c\udffe\n\u2022 Management plane isolation\n\u2022 Credential hygiene in network appliances\n\u2022 Detection capabilities focused on control plane anomalies\n\u2022 SOC playbooks covering network infrastructure compromise\ud83e\udd19\ud83c\udffe\n\nIn many breaches today, the firewall, SD-WAN controller, or edge appliance becomes the attacker\u2019s first domain controller.\n\n\u2014 CISO as a Service \u2014\nStrategic Cyber Defense & GRC\nResilient Through Knowledge\n2026.03.12\n\n#CyberSecurity #ThreatIntelligence #SDWAN #Fortinet #CiscoSecurity #ZeroDay #APT28 #SecurityGovernance #SOC #vCISO\n\nhttps://www.linkedin.com/posts/alirezaghahrood_cybersecurity-threatintelligence-sdwan-share-7437860289229910017-U23V", "creation_timestamp": "2026-09-10T00:00:56.041255Z"}]}