Active exploitation of Cisco Catalyst SD-WAN by UAT-8616

A sophisticated threat actor, UAT-8616, has been actively exploiting a critical authentication bypass vulnerability (CVE-2026-20127) in Cisco Catalyst SD-WAN controllers to gain persistent, high-privilege access to targeted networks—including critical infrastructure—by chaining zero-day and known flaws, evading detection for years.