Cisco Catalyst SD-WAN

Mentions · 7d5
Mentions · 30d5
All mentions5
First seenOct 28, 2026
Last mentioned1d ago

Timeline

5 articles · newest first

Volt Typhoon used rotating Silent Train relays for zero-days

Lumen says exploited products included Versa, N-able, Cisco SD-WAN, VeloCloud and possibly Quest KACE; KeyDrift hit Cisco controllers.

Help Net Securityupdated 00:10 UTC · 20h agofirst Oct 29, 13:42 UTC · 1d agoThreat actorExploited14 sourcesCVE-2024-39717 CVE-2025-8875 CVE-2025-8876+21

Volt Typhoon used Silent Train for US zero-day intrusions

Lumen says four confirmed zero-day campaigns hit management platforms, with credential theft and chains of compromised devices.

Cyber Security Newsupdated 00:10 UTC · 20h agofirst Oct 29, 12:48 UTC · 1d agoThreat actorExploited14 sourcesCVE-2025-8875 CVE-2025-8876 CVE-2026-20127+11

Volt Typhoon-linked actor exploited Cisco SD-WAN zero-day to steal encryption keys

CVE-2026-20127 (CVSS 10) gives unauthenticated admin access to SD-WAN controllers; KeyDrift malware siphoned keying material and Volt Typhoon kept exploiting the flaw after disclosure.

SecurityWeekupdated 00:10 UTC · 20h agofirst Oct 29, 10:29 UTC · 1d agoExploit / PoCExploited14 sourcesCVE-2026-2012713 · 3 reads

Volt Typhoon uses Silent Train relays for zero-day edge attacks

Black Lotus Labs says four confirmed zero-days hit VeloCloud, Cisco SD-WAN, N-central, and Versa Director.

BleepingComputerupdated 00:10 UTC · 20h agofirst Oct 28, 16:00 UTC · 2d agoThreat actorExploited14 sourcesCVE-2026-16812 CVE-2026-20127 CVE-2025-8875+21

Volt Typhoon rebuilt Silent Train relay chains since late 2023

Black Lotus Labs says chains were rebuilt in under two minutes and hundreds of victims were notified.

CyberScoopupdated 00:10 UTC · 20h agofirst Oct 28, 16:00 UTC · 2d agoThreat actorExploited14 sources1

Related CVEs

by mentions

CVE-2026-2012789%10.0
Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator
published Feb 25, 2026Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart)KEV
CVE-2026-168122%10.0
OS Command Injection in Arista VeloCloud Orchestrator On-Prem
published Jul 27, 2026Arista VeloCloud Orchestrator On-PremKEV
CVE-2025-88764%9.4
OS Command Injection in N-able N-central Before 2025.3.1
published Aug 14, 2025N-able N-centralKEV
CVE-2025-88753%9.4
Insecure Deserialization Code Execution in N-able N-central (KEV)
published Aug 14, 2025N-able N-centralKEV
CVE-2024-397174%7.2
Unrestricted File Upload in Versa Networks Versa Director Exploited by Volt Typhoon
published Aug 22, 2024Versa Networks Versa DirectorKEV

Appears with

Volt Typhoonthreat actor · 5
Ciscovendor · 5
Black Lotus Labsorganization · 5
VeloCloud Orchestratorproduct · 4
Versa Directorproduct · 4
Versavendor · 3
Questvendor · 3
Quest KACEproduct · 3
Silent Trainmalware · 2
Lumenorganization · 2
N-able N-centralproduct · 2
N-ablevendor · 2
Netgearvendor · 2
N-centralproduct · 2
KeyDriftmalware · 2
FBIorganization · 2

Entities are extracted by the model from each article. First seen Oct 28, 2026, last mentioned 1d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.