Skip to content
You can now search across every topic, entity and event.What's new
Cybersecurity: Threats and Defences
5SEP

UAT-8616 keeps Cisco SD-WAN under fire

3 min read
12:09UTC

CISA added Cisco SD-WAN CVE-2026-20182 (CVSS 10.0) to the KEV catalogue on 14 May with a three-day federal deadline, after UAT-8616 was confirmed exploiting the authentication bypass over DTLS port 12346 with SSH key injection and log clearing.

← Back to Four privileged platforms under live attackJump to analysis ↓
TechnologyDeveloping
Key takeaway

Cisco SD-WAN is now a six-CVE-deep exploitation surface with ORB overlap to a sixteen-agency-named adversary.

The Cybersecurity and Infrastructure Security Agency (CISA), the US federal civilian cyber-defence authority inside the Department of Homeland Security, added Cisco SD-WAN CVE-2026-20182 to its Known Exploited Vulnerabilities (KEV) catalogue on Thursday 14 May 2026 and issued Emergency Directive ED 26-03 with a three-day federal remediation window expiring Sunday 17 May. The vulnerability scores CVSS 10.0, the maximum severity on the Common Vulnerability Scoring System 1 2.

The vulnerable surface is the vdaemon service on Catalyst SD-WAN Manager and Controller, listening on DTLS port 12346. UAT-8616, the cluster CISA confirmed exploiting the flaw, conducted SSH key injection, NETCONF configuration manipulation, account creation, and log clearing once inside. Per CISA's advisory, UAT-8616's Operational Relay Box infrastructure overlaps with Flax Typhoon and Integrity Technology Group networks named in the sixteen-agency joint advisory published on 23 April 2026 . Integrity Technology Group, the Beijing firm sanctioned by the US Office of Foreign Assets Control in December 2025, remains formally identified as the infrastructure operator behind Flax Typhoon's covert proxy estate.

This is the sixth Cisco SD-WAN CVE catalogued and exploited in 2026, following three earlier SD-WAN Manager CVEs added on 20 April with the shortest federal deadline of that window . The sustained operational tempo against one product family is a continuation of the FIRESTARTER edge-device exposure documented by CISA and the UK NCSC on 24 April , where UAT-4356 deployed a backdoor on the vendor's firewall estate that persisted through every patch and firmware update. For network defenders, two adversary clusters are now demonstrably present inside the same vendor's edge estate within a fortnight.

Deep Analysis

In plain English

Cisco makes software that manages corporate networks across multiple locations. A flaw rated 10 out of 10 in severity let attackers log into that management software without a password. A group linked to Chinese state hacking then used this flaw to plant hidden access inside corporate networks.

Deep Analysis
Root Causes

The vdaemon service's DTLS port 12346 was designed for high-performance SD-WAN tunnel establishment, a protocol optimised for throughput over strict authentication. The certificate-validation weakness in CVE-2026-20182 reflects an architectural trade-off made at design time: DTLS sessions were terminated before the authentication layer was fully applied, creating an authentication bypass window that is structurally difficult to close without protocol re-architecture.

The broader pattern, six Cisco SD-WAN CVEs exploited in 2026, reflects a sustained adversary investment in a product family that sits at the network-management plane of enterprise and government WANs. Once inside SD-WAN Manager, an actor controls traffic routing, encryption keys, and access policy across the entire SD-WAN overlay, making it a higher-leverage target than individual endpoint compromises.

Sources:Cybersecurity and Infrastructure Security Agency·Help Net Security
Mentions:Cisco →Flax Typhoon →Integrity Technology Group →BOD 22-01 →FIRESTARTER →Known Exploited Vulnerabilities →UAT-4356 →ArcaneDoor →Firepower →China →Beijing →NCSC →MikroTik →Common Vulnerability Scoring System →OFAC →Emergency Directive ED 26-03 →UAT-8616 →CVE-2026-20182 →CISA →
First Reported In

Update #4 · AI joins the breach column on both sides

Cybersecurity and Infrastructure Security Agency· 20 May 2026
Read original →
Causes and effects
This Event
UAT-8616 keeps Cisco SD-WAN under fire
The sixth Cisco SD-WAN CVE catalogued in 2026, exploited by an actor whose ORB infrastructure overlaps with networks named in the sixteen-agency Flax Typhoon advisory. The pattern is sustained, not episodic.
Led to
FIRESTARTER implant survives every Cisco firewall patch
UAT-8616's exploitation of CVE-2026-20182 continues the sustained campaign against Cisco edge devices documented with FIRESTARTER on 24 April, sharing ORB infrastructure.
Occurred 24 Apr 2026
Read story →
Sixteen agencies put IOC extinction in print
UAT-8616's ORB infrastructure overlaps with Flax Typhoon and Integrity Technology Group named in the sixteen-agency joint advisory of 23 April 2026.
Occurred 23 Apr 2026
Read story →
VPN zero-day open a month pre-patch
Cisco SD-WAN ED 26-03 confirmed ransomware actors targeting SD-WAN concentrators; the Check Point VPN zero-day extends the same pattern of ransomware affiliates using network perimeter devices as initial-access vectors.
Occurred 8 Jun 2026
Read story →
Triple CVSS-10 Ubiquiti chain hits root
The earlier 3-day ED 26-03 emergency for Cisco SD-WAN CVSS 10.0 was informal; BOD 26-04 now codifies that urgency for the Ubiquiti batch.
Occurred 23 Jun 2026
Read story →
Cisco tops a five-vendor KEV batch
Cisco's May CVSS-10 SD-WAN flaw under active UAT-8616 exploitation is followed by two more Cisco KEV entries in this fortnight's batch.
Occurred 29 Jun 2026
Read story →
Different Perspectives
ENISA
ENISA
ENISA published an SME cyber-resilience maturity model on 6 August and updated the Cyber Resilience Act reporting-platform FAQ on 31 August. The agency supplies common implementation tools for smaller operators, but it cannot fine organisations that do not use them.
UAE Cyber Security Council
UAE Cyber Security Council
On 10 August, the UAE Cyber Security Council said national teams contained attacks on aviation, energy and education before objectives were reached. Its second monthly statement, after a 3 July financial-sector disclosure, makes public reporting of stopped attacks part of its operating posture.
South African authorities
South African authorities
INTERPOL said on 25 August that South African authorities made 39 arrests, seized US$2.67 million and blocked 257 accounts during Operation Jackal IV. Their share of the 23-country operation shows the material enforcement burden in a cross-border fraud case.
Europol
Europol
On 2 September, Europol announced the sinkholing of Sality after a 31 August operation involving US, Bulgarian, Hungarian and Romanian authorities. Its more than 11 million linked IP addresses measure infrastructure contact, not confirmed victims, and show why technical partners joined the action.
CISA
CISA
From 3 August to 2 September, CISA recorded three-day deadlines for 24 of 37 KEV additions, compared with 34 of 39 from 10 June to 29 July. The falling share changes the urgency signal that US federal agencies and private-sector tooling draw from the catalogue.
Beacon
Beacon
On 3 September, Beacon said its final report found that an intruder likely exported its customer database during roughly one hour and 27 minutes on 27 July. Charities using the CRM now have a named exposure route, a compromised AWS access key in public build artefacts.