Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Cisco Catalyst SD-WAN unauthorized peering and SSH access campaign

Campaign
First reported
Last updated
Happening score
H score 38
1 unique sources, 1 articles

Summary

Hide ▲

An active campaign used unauthorized peering connections and SSH access to maintain footholds inside a service provider's Cisco Catalyst SD-WAN environment, increasing the risk of stealthy control-plane access. Activity was observed from late 2025 into March 2026, suggesting a persistent operation rather than a one-off event. The operator used that access to change default account passwords and evade detection. The campaign matters because SD-WAN control planes can provide wide-scale access to internal enterprise traffic.

Related Happenings

Cisco security patch release for CVE-2026-20245

Security Patch Release
H score38 First: 25.06.2026 00:29 Last: 25.06.2026 00:29 Sources 1

How related: The tech giant started releasing Catalyst SD-WAN Manager updates with the CVE-2026-20245 fix on June 10.

About this happening: Cisco released security updates for Cisco Catalyst SD-WAN after CVE-2026-20245 was linked to root-level command execution, and customers were told to move to fixed sof...

Open Happening

CISA adds CVE-2026-20262 to KEV and orders federal fixes

Public Sector Action
H score32 First: 16.06.2026 09:05 Last: 16.06.2026 09:05 Sources 1

About this happening: CISA added CVE-2026-20262 to its Known Exploited Vulnerabilities (KEV) catalog and required Federal Civilian Executive Branch (FCEB) agencies to apply Cisco's fixe...

Open Happening

Cisco Catalyst SD-WAN Manager actively exploited file upload overwrite flaw (CVE-2026-20262)

Vulnerability
H score24 First: 15.06.2026 20:12 Last: 15.06.2026 20:12 Sources 1

About this happening: Cisco Catalyst SD-WAN Manager was patched for CVE-2026-20262 after attackers used it to create or overwrite files and escalate to root across all deployment type...

Open Happening

Cisco security patch release for CVE-2026-20262

Security Patch Release
H score47 First: 15.06.2026 20:12 Last: 15.06.2026 20:12 Sources 1

About this happening: Cisco released security updates for CVE-2026-20262 in Catalyst SD-WAN Manager, covering multiple release trains after the zero-day was exploited to reach root pr...

Open Happening

Velvet Ant Linux login-layer persistence campaign

Campaign
H score41 First: 12.06.2026 21:17 Last: 12.06.2026 21:17 Sources 1

About this happening: A Velvet Ant campaign was uncovered that quietly maintained access by backdooring Linux PAM and OpenSSH components, putting credential capture and command logging inside t...

Open Happening

Timeline

  1. 25.06.2026 17:15 2 articles · 20d ago

    Cisco Catalyst SD-WAN unauthorized peering and SSH access campaign

    Initial Disclosure

    From late 2025 to January 2026, repeated unauthorized peering connections were observed against a service provider's SD-WAN Manager devices. The activity later reappeared in March 2026, indicating continued access attempts.

    Show sources
    Open in new tab