Ongoing exploitation of Cisco Catalyst SD
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20122 | Arbitrary File Overwrite via Privileged APIs in Cisco Catalyst SD-WAN Manager | 5.4 | 26% | KEV | KEV |
| CVE-2026-20127 | Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator | 10.0 | 89% | KEV | KEV |
CVE-2026-20133+1 related CVE | Actively Exploited Information Disclosure in Cisco Catalyst SD-WAN Manager | 7.5 | 31% | KEV | KEV |
| CVE-2026-20182 | Authentication Bypass in Cisco Catalyst SD-WAN Control Components | 10.0 | 92% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 1a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p.worf.replit | Cluster 8 - Download URL for the Nim-based backdoor hxxps://1a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p[.]worf[.]replit.dev/download Cluster 8 - Attacker controlled sub-domain |
| domain | a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p.worf.replit | tacker controlled sub-domain hosting the Nim-based backdoor a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p[.]worf[.]replit.dev Cluster 8 - Attacker IP that downloaded the Nim-bas |
| domain | replit.dev | aded and executed post-compromise from the remote location “replit[.]dev”: Figure 6. Download and startup script for the Nim-based |
| ipv4 | 104.233.156.1 | e attributed to this cluster: 38.60.214[.]92 65.20.67[.]134 104.233.156[.]1 194.233.100[.]40 Figure 4. Godzilla webshell deployed in |
| ipv4 | 13.62.52.206 | d by the agent to communicate with the C2 hosted on “hxxp://13[.]62[.]52[.]206:5004”. This tool was downloaded and executed post-com |
| ipv4 | 176.65.139.31 | 5a80 Cluster 8 - IP related to Nim-based backdoor and KScan 176[.]65[.]139[.]31 Cluster 9 - gsocket d94f75a70b5cabaf786ac57177ed84173 |
| ipv4 | 194.163.175.135 | temd-resolved” and the agent’s command and control (C2) is “194[.]163[.]175[.]135:4445”. The authors have changed the default TCP banne |
| ipv4 | 194.233.100.40 | this cluster: 38.60.214[.]92 65.20.67[.]134 104.233.156[.]1 194.233.100[.]40 Figure 4. Godzilla webshell deployed in Cluster #4. Clust |
| ipv4 | 212.83.162.37 | Behinder webshell under the filename “sysinit.jsp”. The IP “212.83.162[.]37” was used to carry out the exploit and interact with the |
| ipv4 | 23.27.143.170 | with the filename “CWan”. The Sliver sample’s C2 is “mtls://23.27.143[.]170:443”. Cluster 7 In this cluster of activity, since at lea |
| ipv4 | 38.181.52.89 | y out the exploit and subsequently interact with the shell: 38.181.52[.]89 89.125.244[.]33 89.125.244[.]51 Figure 1. Tas9er Godzilla |
| ipv4 | 38.60.214.92 | ikp.jsp”. The following IPs are attributed to this cluster: 38.60.214[.]92 65.20.67[.]134 104.233.156[.]1 194.233.100[.]40 Figure 4. |
| ipv4 | 47.104.248.7 | 98161056b7c8f70c9724d8a63abc7ff8c3843b91c30cffab0899e39b7f8 47[.]104[.]248[.]7 b0f51b098842cd630097b462aab0ec357e2c7824af37cca6d0816 |
| ipv4 | 65.20.67.134 | ollowing IPs are attributed to this cluster: 38.60.214[.]92 65.20.67[.]134 104.233.156[.]1 194.233.100[.]40 Figure 4. Godzilla websh |
| ipv4 | 71.80.85.135 | AES encryption commonly observed in other variants. The IP “71.80.85[.]135” was used to carry out the exploit and interact with the |
| ipv4 | 79.135.105.208 | the compromised system while connected from the source IP “79[.]135[.]105[.]208”. This is likely a ProtonVPN node. Replit is an AI pl |
| ipv4 | 83.229.126.195 | d and deployed via a shell script from the remote location “83.229.126[.]195”. Figure 5. Download and startup script for XMRig. This I |
| ipv4 | 89.125.244.33 | it and subsequently interact with the shell: 38.181.52[.]89 89.125.244[.]33 89.125.244[.]51 Figure 1. Tas9er Godzilla shellcode deplo |
| ipv4 | 89.125.244.51 | tly interact with the shell: 38.181.52[.]89 89.125.244[.]33 89.125.244[.]51 Figure 1. Tas9er Godzilla shellcode deployed in Cluster # |
| md5 | fece5b954e69b2c6a8d0a1029631a0d7 | ong with a Mythic C2 server certificate with serial number: fece5b954e69b2c6a8d0a1029631a0d7 Another AdaptixC2 server on port 31337 An open SSH service |
| sha256 | 02654acfb21f83485393ba8b14bd8862b919b9ec966fc6768f6aac1338a45ee8 | - AdaptixC2 C2 IP 194[.]163[.]175[.]135 Cluster 6 - Sliver 02654acfb21f83485393ba8b14bd8862b919b9ec966fc6768f6aac1338a45ee8 Cluster 6 - Sliver C2 over mTLS mtls[://]23.27.143[.]170:44 |
| sha256 | 0c87871642f84e09e8d3fb23ec36bf55601323e31151a7017a85dbec929cf15d | 126[.]195:8081/config[.]json Cluster 8 - Nim-based backdoor 0c87871642f84e09e8d3fb23ec36bf55601323e31151a7017a85dbec929cf15d Cluster 8 - Download URL for the Nim-based backdoor hxxps:/ |
| sha256 | 0ed72d52347bfe4a78afff8a6982a64050c8fc86d8957a20eeb3e0f3f5342ed0 | r C2 IP 23.27.143[.]170 Cluster 7 - XMRig downloader script 0ed72d52347bfe4a78afff8a6982a64050c8fc86d8957a20eeb3e0f3f5342ed0 Cluster 7 - XMRig sample 96fc528ca5e7d1c2b3add5e31b8797cb12 |
| sha256 | 17302d903baf182f94dc3be40ab1e0874dd0eb2ec5255bf9131fd53591efe925 | 0ce97de3eaaffef33d90b0c337a153fc9690cc34ee207b557d868360060 17302d903baf182f94dc3be40ab1e0874dd0eb2ec5255bf9131fd53591efe925 |
| sha256 | 18d77c9c5bbb5b9d5bdfd366fdfcf26bad9e64c63ca865fad711bcce8e3d5a80 | ckdoor 13[.]62[.]52[.]206 Cluster 8 - KScan – scanning tool 18d77c9c5bbb5b9d5bdfd366fdfcf26bad9e64c63ca865fad711bcce8e3d5a80 Cluster 8 - IP related to Nim-based backdoor and KScan 176[ |
| sha256 | 5bc5998161056b7c8f70c9724d8a63abc7ff8c3843b91c30cffab0899e39b7f8 | bdcc9a29e06e5b41d9be567bcfa Cluster 9 - gsocket secret file 5bc5998161056b7c8f70c9724d8a63abc7ff8c3843b91c30cffab0899e39b7f8 47[.]104[.]248[.]7 b0f51b098842cd630097b462aab0ec357e2c7824 |
| sha256 | 72f570ce97de3eaaffef33d90b0c337a153fc9690cc34ee207b557d868360060 | cca6d08165265da2c2d3 Cluster 10 - Check for root escalation 72f570ce97de3eaaffef33d90b0c337a153fc9690cc34ee207b557d868360060 17302d903baf182f94dc3be40ab1e0874dd0eb2ec5255bf9131fd53591e |
| sha256 | 7aa88a64a527ade7d93c20faf23b54f2ee33ad9b1246cdc2f8ded2ab639affb1 | 04976c8fbeaecdbf0aa4309ad46 Cluster 7 - XMRig configuration 7aa88a64a527ade7d93c20faf23b54f2ee33ad9b1246cdc2f8ded2ab639affb1 Cluster 7 - XMRig remote location IP 83[.]229[.]126[.]195 C |
| sha256 | 96fc528ca5e7d1c2b3add5e31b8797cb126f704976c8fbeaecdbf0aa4309ad46 | 4050c8fc86d8957a20eeb3e0f3f5342ed0 Cluster 7 - XMRig sample 96fc528ca5e7d1c2b3add5e31b8797cb126f704976c8fbeaecdbf0aa4309ad46 Cluster 7 - XMRig configuration 7aa88a64a527ade7d93c20faf23 |
| sha256 | b0f51b098842cd630097b462aab0ec357e2c7824af37cca6d08165265da2c2d3 | 4d8a63abc7ff8c3843b91c30cffab0899e39b7f8 47[.]104[.]248[.]7 b0f51b098842cd630097b462aab0ec357e2c7824af37cca6d08165265da2c2d3 Cluster 10 - Check for root escalation 72f570ce97de3eaaffef |
| sha256 | d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa | backdoor and KScan 176[.]65[.]139[.]31 Cluster 9 - gsocket d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa Cluster 9 - gsocket secret file 5bc5998161056b7c8f70c9724d8 |
| sha256 | f6f8e0d790645395188fc521039385b7c4f42fa8b426fd035f489f6cda9b5da1 | ]134 104.233.156[.]1 194.233.100[.]40 Cluster 5 - AdaptixC2 f6f8e0d790645395188fc521039385b7c4f42fa8b426fd035f489f6cda9b5da1 Cluster 5 - AdaptixC2 C2 server 194[.]163[.]175[.]135:4445 |
| url | http://13.62.52.206:5004 | 79[.]135[.]105[.]208 Cluster 8 - C2 for Nim-based backdoor hxxp://13[.]62[.]52[.]206:5004 Cluster 8 - C2 IP for Nim-based backdoor 13[.]62[.]52 |
| url | http://13.62.52.206:5004” | be used by the agent to communicate with the C2 hosted on “hxxp://13[.]62[.]52[.]206:5004”. This tool was downloaded and executed post-compromis |
| url | http://83.229.126.195:8081/config.json | /xmrig Cluster 7 - XMRig configuration file remote location hxxp://83[.]229[.]126[.]195:8081/config[.]json Cluster 8 - Nim-based backdoor 0c87871642f84e09e8d3 |
| url | http://83.229.126.195:8081/xmrig | cation IP 83[.]229[.]126[.]195 Cluster 7 - XMRig remote URL hxxp://83[.]229[.]126[.]195:8081/xmrig Cluster 7 - XMRig configuration file remote location |
| url | https://1a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p.worf.replit.dev/download | 29cf15d Cluster 8 - Download URL for the Nim-based backdoor hxxps://1a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p[.]worf[.]replit.dev/download Cluster 8 - Attacker controlled sub-domain hosting the |
From the original article
9 min read at blog.talosintelligence.com
Cisco Talos is tracking the active exploitation of CVE-2026-20182 , an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage. Successful exploitation of CVE-2026-20182 allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.