China-linked hackers implanted custom malware inside SD-WAN controllers to siphon AES keys protecting encrypted traffic between sites.

State-sponsored threat actors are compromising critical enterprise network infrastructure. Specifically, operators tracking as UAT-11473 breached Cisco Catalyst SD-WAN controllers across strategic industries. Intruders deployed a sophisticated in-memory malware suite dubbed KeyDrift into active system processes. This espionage campaign compromised satellite operators, aerospace manufacturers, defense contractors, and geopolitical think tanks. Furthermore, the malware extracts cryptographic keys directly from decrypted control streams.

Deploy a global, high availability network in minutes on Megaport’s industry-leading Network as a Service (NaaS) platform.

A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift.

Arista Networks patches critical, actively exploited zero-day vulnerability CVE-2026-114625 in VeloCloud Orchestrator.

Cisco has disclosed a critical authentication bypass vulnerability in the Catalyst SD-WAN Manager, which could allow unauthenticated remote attackers to access the management API with administrator pr...

TL;DR Juniper Networks has patched 18 Session Smart Router vulnerabilities in its October 28 security bulletin, JSA112183. Two critical flaws score 9.8 on CVSS v3.1 and need no login. The bugs also affect Session Smart Conductor, the management platform for these routers. Unauthenticated attackers could run commands on the Conductor or gain admin rights on the router. Juniper's own testing found all 18 issues.

TL;DR Juniper Networks has patched 18 Session Smart Router vulnerabilities in its October 28 security bulletin, JSA112183. Two critical flaws score 9.8 on CVSS v3.1 and need no login. The bugs also affect Session Smart Conductor, the management platform for these routers. Unauthenticated attackers could run commands on the Conductor or gain admin rights on the router. Juniper's own testing found all 18 issues.

Arista Networks patches critical, actively exploited zero-day vulnerability CVE-2026-114625 in VeloCloud Orchestrator.

Deploy a global, high availability network in minutes on Megaport’s industry-leading Network as a Service (NaaS) platform.

目前有一种方案试下来很稳，某亚洲外资运营商的 sdwan ，独享 isp ip 但是价格是真贵，封号率倒是很低，而且这条线路上封的号申诉全部成功了 弄不清到底是 ip 干净所以封号率低，还是 sdwan 有什么其他神奇之处。如果我买个独享 ip 的家宽 vps 开全局能不能达到一样的效果？这个比 sdwan 要便宜不少

TL;DR Arista says attackers are actively exploiting CVE-2026-114625, a critical VeloCloud Orchestrator vulnerability rated CVSS 9.9. The SQL injection flaw lets any logged-in user gain "superuser operator" privileges on on-prem VCO. Fixes are available in VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12. Why It Matters VeloCloud Orchestrator manages SD-WAN networks, so it controls traffic across many branch sites. A takeover can therefore reach far beyond one server.

Cato enables customers to gradually transform their networking and security infrastructure for the digital business.

High performance policy routed IPsec mesh SD-WAN with userspace ESP, IKEv2, an embedded Babel speaker and SRv6 steering.

A subsidiária de telecomunicações corporativas da Axtel atualizou sua plataforma de redes definidas por software com inspeção profunda em nós locais e orquestração distribuída.

Cato enables customers to gradually transform their networking and security infrastructure for the digital business.

Deploy a global, high availability network in minutes on Megaport’s industry-leading Network as a Service (NaaS) platform.

## Summary On September 30, 2026, Cisco published advisory **cisco-sa-sdwan-webauth-xr8beuuU** for **CVE-2026-76504** , an authentication bypass in Cisco Catalyst SD-WAN Manager rated **CVSS 9.8 (Critical)**. A remote attacker with no credentials can gain **admin-level API access with a single crafted HTTP request** — by percent-encoding one character in the request URI. Cisco's own PSIRT confirmed the flaw was **actively exploited in September 2026** , discovered during a real TAC support case. CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a federal patch deadline of October 3. There are no workarounds. One SD-WAN Manager instance can administer up to **6,000 devices** — so admin API access here reaches every branch office, every WAN edge, everything. ## Severity * **CVE ID:** CVE-2026-76504 * **Title:** Cisco Catalyst SD-WAN Manager authentication bypass vulnerability * **CVSS 3.1:** 9.8 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * **Weakness:** CWE-177 — improper handling of URL encoding (hex encoding) * **Attack requirements:** None — unauthenticated, remote, single request * **Exploited in the wild:** Yes — confirmed by Cisco PSIRT, active exploitation in September 2026 * **CISA KEV:** Added September 30, 2026 — federal deadline October 3 The vector is the maximum: network-accessible, low complexity, **no privileges, no user interaction** , full impact on confidentiality, integrity, and availability. A 9.8 that is both actively exploited and KEV-listed is the highest-priority class of vulnerability a defender will see this year. ## Affected Versions Cisco Catalyst SD-WAN Manager is affected **regardless of configuration** — there is no setting that avoids this. Fixed releases: * **20.9 branch** — fixed in 20.9.10.1 * **20.12 branch** — fixed in 20.12.8.2 * **20.15 branch** — fixed in 20.15.6.1 (cloud-hosted 20.15.605 was already fixed) * **20.18 branch** — fixed in 20.18.4.1 * **26.1 branch** — fixed in 26.1.2.1 * **26.2 branch** — fixed in 26.2.1 **Releases earlier than 20.9 have no fix — you must migrate** to a supported release. Check your version with the standard CLI/GUI version commands on the Manager; if the Manager is internet-reachable and below a fixed build, treat it as compromised until proven otherwise. ## Technical Analysis **The one-character bypass.** The root cause is CWE-177: improper handling of URL encoding in the API's session-based authentication. Here is the mechanism, reconstructed from the advisory's description. The authentication layer guards a sensitive endpoint — the **j_security_check** login-check path — with a filter that does a **literal string match** on the request URI. The attacker percent-encodes a single character of that path, for example sending **%6a** (the hex encoding of the letter "j") instead of the literal "j". The filter compares the raw, still-encoded string against its rule, finds no match, and waves the request through as if it needed no authentication. The backend then **decodes the URI before routing** , sees the real protected endpoint, and serves it — with the request now treated as privileged. Two components disagree about what the request _is_ , and the attacker's request slips through the gap between them. **Why this bug class never dies.** Encoding-normalization mismatches are one of the oldest tricks in web security — directory traversal via %2e%2e, filter evasion via double-encoding, the classics. They keep recurring because the fix is architectural, not local: _every_ layer that inspects a request must agree on the canonical form of that request before any security decision is made. A filter that matches on the raw string while the router decodes first is a design flaw, not a typo — and it survives code review because each component looks correct in isolation. Cisco shipping this in 2026, in the management plane of its flagship SD-WAN product, shows that even mature vendors still get canonicalization wrong at security boundaries. **Admin API access is total access.** This is not a read-only leak or a limited privilege gain. The attacker lands with **administrator-level API access** to the SD-WAN Manager — the single pane of glass that provisions, monitors, and configures the entire SD-WAN fabric. One Manager can oversee up to 6,000 devices. From that position an attacker can push configuration to every branch router, harvest device credentials, alter routing policy to redirect traffic, or use the management network as a launchpad into the enterprise. The blast radius of one HTTP request is the whole WAN. **Found in a support case, not a lab.** Cisco PSIRT became aware of active exploitation through a **TAC support case** — meaning a real customer, with a real incident, brought the evidence to Cisco. Exploitation-in-the-wild was not a theoretical forecast; it was already happening before the advisory existed. Combined with the CISA KEV listing on day one and a three-day federal patch deadline, the message to every other SD-WAN Manager operator is blunt: attackers already had this before you heard about it. The question is not whether your instance was probed, but whether it was exploited — and the detection guidance below is how you start answering that. **Detection: read the logs like an attacker.** Cisco's advisory points defenders at two log sources: **serviceproxy-access.log** and **vmanage-server.log**. Look for requests to **j_security_check** containing **percent-encoded characters** (such as %6a) arriving from unknown or unexpected IP addresses — that is the fingerprint of this bypass. Separately, watch for suspicious activity by internal service accounts, particularly ones named **viptela-reserved-** *, which attackers may abuse or impersonate after gaining access. If those logs are not retained or not centralized, fix that first — you cannot investigate an incident you cannot see. Note that legitimate traffic to these endpoints is rare, which makes the signal-to-noise ratio unusually favorable: encoded requests to the auth endpoint from unfamiliar sources are worth treating as hostile until proven otherwise. ## Why This Matters SD-WAN Manager is the control plane of the wide-area network. Compromising a control plane is categorically worse than compromising a single device, because the control plane _defines_ what the network does. An attacker with admin API access does not need to hack 6,000 routers — they can simply ask the Manager to reconfigure them. And because this flaw needs no credentials and a single request, it is trivially scannable: every internet-exposed Manager on the planet could have been fingerprinted within days of disclosure. This also fits this month's grim pattern of broken access control in enterprise infrastructure — alongside the Exchange authorization flaw covered earlier this month. Different vendors, different products, same root story: the code that decides _who is allowed_ keeps failing, and the failures keep being remotely exploitable. ## Mitigation * **Patch now — no workarounds exist.** Upgrade to the fixed release on your branch (20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, or 26.2.1). If you are on a release earlier than 20.9, plan the migration immediately — there is no patch coming for those branches. * **Assume breach if you were exposed.** If your Manager was internet-reachable and unpatched at any point in September, do not just patch and move on. Audit serviceproxy-access.log and vmanage-server.log for encoded j_security_check requests from unknown IPs, and review activity by viptela-reserved-* service accounts. * **Rotate credentials across the fabric.** Admin API access can harvest device credentials and session material. Rotate Manager admin credentials, API tokens, and device credentials managed through the fabric — not just the Manager's own password. * **Restrict management-plane exposure.** SD-WAN Manager has no business being broadly reachable from the internet. After patching, lock management access behind VPN or strict allow-lists. The next control-plane flaw should find no exposed target. * **Meet the KEV deadline — then beat it.** CISA's federal deadline was October 3. If you are still unpatched, you are already past the line the US government drew for its own agencies. Treat that as the signal it is. ## References * Cisco security advisory cisco-sa-sdwan-webauth-xr8beuuU — CVE-2026-76504 (published September 30, 2026) * CISA Known Exploited Vulnerabilities catalog — CVE-2026-76504 (added September 30, 2026) * NVD entry for CVE-2026-76504 (CWE-177) Report by Faizan Akhtar — The Cyber Security Researcher