Lumen says Volt Typhoon banks Silent Train access in infrastructure
Lumen says the group rotates exploited SOHO, IoT and enterprise devices, including multiple zero-days, against high-value targets.
1
Stories per day · 30 days
5 RSS
Relatedvolt-typhoon9zero-day8arista6velocloud6cisco5keydrift5silent-train5sql-injection5authentication-bypass4critical-infrastructure3orchestrator2actively-exploited1catalyst1china1encryption-keys1kev1n-central1relay-network1
36 stories, newest first · one card per story
Stories tagged #sd-wan
Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
CVE-2026-20127, patched in February 2026, lets attackers add rogue peers and steal IPsec key material from controllers.
Cisco SD-WAN zero-day CVE-2026-20127 used to install KeyDrift
Talos says UAT-11473 stole suspected IPsec keys from space, defense, and policy targets; patches shipped in February 2026.
KeyDrift malware steals SD-WAN encryption keys via CVE-2026-20127
UAT-11473 uses a CVSS 10.0 auth bypass on Cisco Catalyst SD-WAN to plant in-process key stealers; fixes exist but no workaround.
Volt Typhoon used Silent Train for US zero-day intrusions
Lumen says four confirmed zero-day campaigns hit management platforms, with credential theft and chains of compromised devices.
1
Volt Typhoon used Silent Train relays to hide zero-day attacks
Lumen links the relay network to four confirmed zero-days and one likely flaw, with sessions rebuilt in under two minutes.
Cisco Catalyst SD-WAN peering flaw bypasses authentication for admin access
An unauthenticated remote attacker can send crafted requests and log in with administrative privileges.
UAT-11473 used Cisco SD-WAN auth bypass to plant KeyDrift
Talos says the implant lives in controller processes, steals data-plane keys, and overlaps Volt Typhoon infrastructure.
Volt Typhoon used Silent Train in four zero-day campaigns
Black Lotus Labs says the rotating SOHO and IoT relay network hit hundreds of victims, including US critical infrastructure.
1
CISA adds exploited Arista VeloCloud Orchestrator flaw to KEV
Authenticated SQL injection CVE-2026-114625 can grant operator privileges; federal agencies must fix it by October 26, 2026.
Attackers exploit VeloCloud Orchestrator flaw for superuser access
CVE-2026-114625 is an authenticated SQL injection; Enterprise Read Only is enough, and Arista named two attacking IPs.
2
Arista says VeloCloud Orchestrator flaw CVE-2026-114625 is exploited
Builds before 5.2.3.18, 6.1.3.10, and 6.4.2.12 are affected; Canada's Cyber Centre urges available updates.
Attackers exploit VeloCloud Orchestrator SQL injection zero-day CVE-2026-114625
Any authenticated user on unpatched on-prem VCO can become a superuser operator; Arista says hosted systems are already patched.
Arista says VeloCloud SQL injection zero-day is exploited
A read-only login can become a local superuser; on-prem fixes are 5.2.3.18, 6.1.3.10 and 6.4.2.12.
Arista patches VeloCloud zero-day exploited in attacks
CVE-2026-114625 SQL injection flaw in VeloCloud Orchestrator allows authenticated privilege escalation.
5th October – Threat Intelligence Report
Check Point's weekly digest covers exploited Citrix and Cisco critical flaws, major breaches, and South African aviation ransomware.
6
Critical Cisco Catalyst SD-WAN Zero-Day Under Active Exploitation
Cisco says critical SD-WAN Manager zero-day CVE-2026-76504 is under active exploitation.
Cisco SD-WAN Manager hit by zero-day admin access attack
Cisco patched CVE-2026-76504, a critical SD-WAN Manager authentication bypass already used for remote admin access.
Cisco security advisory (AV26-978)
CISA added Cisco Catalyst SD-WAN Manager API authentication bypass CVE-2026-76504 to the KEV catalog.
CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV
CISA added actively exploited Cisco Catalyst SD-WAN Manager auth bypass CVE-2026-76504 to the KEV catalog.
U.S. CISA adds Cisco Catalyst SD-WAN Manager flaw to its Known Exploited Vulnerabilities catalog
CISA lists actively exploited Cisco SD-WAN Manager flaw CVE-2026-76504 in the KEV catalog.
Cisco Catalyst SD-WAN Manager Authentication Bypass Vulnerability Exploited in Attacks (CVE-2026-76504)
Attackers are exploiting a critical Cisco Catalyst SD-WAN Manager authentication bypass, CVE-2026-76504.
Cisco SD-WAN Manager Authentication 0-day Vulnerability Actively Exploited in the Wild
Cisco warns CVE-2026-76504, a critical SD-WAN Manager auth bypass, is being actively exploited.
CVE-2026-76504 | Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability | Reversed by Horizon3
Actively exploited Cisco SD-WAN Manager flaw CVE-2026-76504 bypasses API authentication for admin access.