{
  "Event": {
    "analysis": "1",
    "date": "2026-06-25",
    "extends_uuid": "",
    "info": "[Threat Intel] Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager",
    "protected": false,
    "publish_timestamp": "1782533498",
    "published": true,
    "threat_level_id": "1",
    "timestamp": "1782533498",
    "uuid": "74e0222b-5573-4720-a828-b09dadf2b300",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#6e57da",
        "local": false,
        "name": "misp-galaxy:producer=\"Mandiant\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#3000b7",
        "local": false,
        "name": "rectifyq:workflow=\"check-key-indicator\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#7773ac",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Account - T1087.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#aad818",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"SSH - T1021.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#9feaf0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
        "relationship_type": ""
      },
      {
        "colour": "#edf46c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Timestomp - T1070.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#9dfeaa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Abuse Elevation Control Mechanism - T1548\"",
        "relationship_type": ""
      },
      {
        "colour": "#20f80d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"",
        "relationship_type": ""
      },
      {
        "colour": "#b24806",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Indicator Removal - T1070\"",
        "relationship_type": ""
      },
      {
        "colour": "#dac154",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Network Connections Discovery - T1049\"",
        "relationship_type": ""
      },
      {
        "colour": "#f95f85",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#71ecdb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Account Manipulation - T1098\"",
        "relationship_type": ""
      },
      {
        "colour": "#e43954",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#59699c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "relationship_type": ""
      },
      {
        "colour": "#6d779a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Privilege Escalation - T1068\"",
        "relationship_type": ""
      },
      {
        "colour": "#ceae8c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"/etc/passwd and /etc/shadow - T1003.008\"",
        "relationship_type": ""
      },
      {
        "colour": "#a05856",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Destruction - T1485\"",
        "relationship_type": ""
      },
      {
        "colour": "#30cc3b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#f055aa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Create Account - T1136\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120044",
        "local": false,
        "name": "rectifyq:sub-category=\"intrusion-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#150052",
        "local": false,
        "name": "rectifyq:sub-category=\"zero-day\"",
        "relationship_type": ""
      },
      {
        "colour": "#d92121",
        "local": false,
        "name": "rectifyq:target=\"targeted\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442821",
        "to_ids": false,
        "type": "link",
        "uuid": "c2144f10-c18c-448e-b8b4-4eb9a91b8d48",
        "value": "https://cloud.google.com/blog/topics/threat-intelligence/zero-day-exploitation-cisco-catalyst-sd-wan-manager"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442821",
        "to_ids": false,
        "type": "text",
        "uuid": "e5fc7a22-5984-464d-ad14-b9aaef695f4e",
        "value": "In early 2026, a threat actor targeted SD-WAN infrastructure at a service provider, exploiting a zero-day vulnerability in Cisco Catalyst SD-WAN to escalate privileges. The attacker initially gained access through unauthorized peering connections and manipulated default account passwords. They then exploited CVE-2026-20245, a privilege escalation flaw in the file upload feature, by uploading a malicious CSV file to achieve root-level access. The vulnerability allowed the creation of a privileged user account through manipulation of system password files. Throughout the intrusion, the threat actor employed extensive anti-forensic techniques, systematically deleting malicious files, restoring modified system configurations, and executing validation scripts to ensure removal of indicators. This campaign demonstrates the living off the edge paradigm, where adversaries compromise network appliances to bypass traditional security perimeters and maintain persistent access."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442821",
        "to_ids": false,
        "type": "text",
        "uuid": "47a26370-53c9-4bd5-bb51-78aba3ec8729",
        "value": "Name: Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager\nAuthor: AlienVault\nAdversary: \nTags: [\"credential manipulation\", \"cve-2026-20245\", \"sd-wan\", \"zero-day\", \"cisco catalyst\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: [\"T1133\", \"T1087.001\", \"T1021.004\", \"T1082\", \"T1190\", \"T1070.006\", \"T1548\", \"T1059\", \"T1070\", \"T1049\", \"T1552.001\", \"T1098\", \"T1562.001\", \"T1078\", \"T1068\", \"T1003.008\", \"T1485\", \"T1070.004\", \"T1136\"]\nIndustries: []"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442821",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "20cfc37d-3e67-4606-a22e-c0a833b718ee",
        "value": "CVE-2026-20127"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442821",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "4751d1aa-4926-4a06-9ea3-808b30bc93ab",
        "value": "CVE-2026-20182"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782442821",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "cbc4acc6-4ea9-41e0-b089-711ebc94e81e",
        "value": "CVE-2026-20245"
      },
      {
        "category": "Payload delivery",
        "comment": "Remnant of malicious CSV file exploiting CVE-2026-20245 No sample in VT\r\nLast check:27/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782527955",
        "to_ids": true,
        "type": "sha256",
        "uuid": "81e3b84d-670c-428d-aa45-19d4c4078a9a",
        "value": "b82936f37648518425c7d3cf9e09eaffa41d7cdb3840f6a40287e3a108880f7b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "IP address connecting as rogue device and exploiting CVE-2026-20245",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528239",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "885b9a79-1ddf-4a7c-99b2-06f3c6f386ba",
        "value": "126.51.108.152",
        "Tag": [
          {
            "colour": "#ffc325",
            "local": false,
            "name": "asn:asn=\"17676\"",
            "relationship_type": ""
          },
          {
            "colour": "#77ed12",
            "local": false,
            "name": "asn:as-owner=\"GIGAINFRA SoftBank Corp.\"",
            "relationship_type": ""
          },
          {
            "colour": "#bab83b",
            "local": false,
            "name": "asn:as-country=\"JP\"",
            "relationship_type": ""
          },
          {
            "colour": "#e8b447",
            "local": false,
            "name": "misp-galaxy:country=\"japan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "IP address connecting as rogue device",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528260",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "007485e5-259f-4dda-bdc3-2e2f008be06a",
        "value": "153.186.231.233",
        "Tag": [
          {
            "colour": "#a13383",
            "local": false,
            "name": "asn:asn=\"4713\"",
            "relationship_type": ""
          },
          {
            "colour": "#76671d",
            "local": false,
            "name": "asn:as-owner=\"OCN NTT Communications Corporation\"",
            "relationship_type": ""
          },
          {
            "colour": "#bab83b",
            "local": false,
            "name": "asn:as-country=\"JP\"",
            "relationship_type": ""
          },
          {
            "colour": "#e8b447",
            "local": false,
            "name": "misp-galaxy:country=\"japan\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "IP address connecting as rogue device",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528281",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "482eb32d-109b-4593-a2f3-14f6c3629910",
        "value": "167.179.79.189",
        "Tag": [
          {
            "colour": "#133012",
            "local": false,
            "name": "asn:asn=\"20473\"",
            "relationship_type": ""
          },
          {
            "colour": "#650025",
            "local": false,
            "name": "asn:as-owner=\"AS-VULTR\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "IP address connecting as rogue device",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528303",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "178740ed-e7d2-431c-a8a4-97c220bbf60e",
        "value": "207.190.37.94",
        "Tag": [
          {
            "colour": "#0f6e48",
            "local": false,
            "name": "asn:asn=\"22827\"",
            "relationship_type": ""
          },
          {
            "colour": "#a4584b",
            "local": false,
            "name": "asn:as-owner=\"SMART-CITY-OCCC\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "IP address connecting as rogue device",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528324",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "e79e6f9f-9e8b-478c-a5d2-5d2b8a6183e4",
        "value": "209.137.225.101",
        "Tag": [
          {
            "colour": "#2c172c",
            "local": false,
            "name": "asn:asn=\"21947\"",
            "relationship_type": ""
          },
          {
            "colour": "#3aa27f",
            "local": false,
            "name": "asn:as-owner=\"BCI\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "IP address connecting as rogue device",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528345",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a1bbf988-976b-431c-be9b-06b255e25971",
        "value": "23.245.7.178",
        "Tag": [
          {
            "colour": "#e42bca",
            "local": false,
            "name": "asn:asn=\"11776\"",
            "relationship_type": ""
          },
          {
            "colour": "#bfd067",
            "local": false,
            "name": "asn:as-owner=\"ATLANTICBB-JOHNSTOWN\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "IP address connecting as rogue device",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528367",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "a295540a-d3b1-40aa-ae90-b778a7fe4731",
        "value": "45.32.38.160",
        "Tag": [
          {
            "colour": "#133012",
            "local": false,
            "name": "asn:asn=\"20473\"",
            "relationship_type": ""
          },
          {
            "colour": "#650025",
            "local": false,
            "name": "asn:as-owner=\"AS-VULTR\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "IP address connecting as rogue device",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782528388",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "0734b822-21d2-4e1e-8875-76cbc824623a",
        "value": "76.92.245.217",
        "Tag": [
          {
            "colour": "#b66ef5",
            "local": false,
            "name": "asn:asn=\"11427\"",
            "relationship_type": ""
          },
          {
            "colour": "#0c2144",
            "local": false,
            "name": "asn:as-owner=\"TWC-11427-TEXAS\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}