tag: Sd-Wan · 7 items
- Engineer — Act: Actively exploited zero-day with no patch yet; any authenticated VCO user can escalate to operator. Immediately restrict network access to the VCO management interface to trusted IPs only, audit all existing VCO accounts, and review recent operator-level activity for unauthorized escalations.
- SOC/IR — Act: Active exploitation of SD-WAN management plane means assume-breach posture is warranted if you have VeloCloud. Sweep VCO audit logs for privilege escalations from low-privilege accounts since at least October 22 and tune alerts for anomalous operator-level configuration changes.
- Leader — Act: Zero-day exploitation of a widely-deployed SD-WAN management system is a material risk event. Confirm whether your organization uses Arista VeloCloud Orchestrator, assess exposure with the network team, and prepare a brief for leadership before this generates inbound questions.
- Engineer — Act: Patch Cisco Catalyst SD-WAN Manager immediately — CVE-2026-76504 is KEV-listed, has a public PoC, and is under active exploitation; unauthenticated remote access at CVSS 9.8 makes this an emergency change window, not a scheduled patch.
- SOC/IR — Act: Assume-breach posture for any environment running Cisco Catalyst SD-WAN Manager: sweep authentication logs for anomalous access since before the KEV listing date and hunt for unauthorized management-plane sessions; apply Cisco’s published IOCs if available.
- Leader — Act: Confirm this week whether your org runs Cisco Catalyst SD-WAN Manager, then direct engineering to treat patching as emergency; active exploitation plus KEV listing makes this a likely customer or board question for network-heavy sectors.
- Signals: CVE-2026-76504 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Patch Cisco Catalyst SD-WAN Manager to the fixed release immediately — Cisco confirms active exploitation of unauthenticated remote admin API access with no workaround available; delay is indefensible.
- SOC/IR — Act: Cisco confirms active exploitation, making this an assume-breach scenario for any org running SD-WAN Manager; hunt for unauthorized admin API calls and unexpected configuration changes on those devices since at least September 30.
- Leader — Act: Confirm this week whether your organization runs Cisco Catalyst SD-WAN Manager, verify the engineering team has a patch window scheduled, and be prepared to brief leadership given active exploitation of admin-level network management access.
- Signals: CVE-2026-76504 — CISA KEV: not listed, EPSS n/a, no public PoC found, reported by 2 collected sources
- Engineer — Act: Actively exploited privilege escalation to admin in Cisco Catalyst SD-WAN Manager with patches released; apply the Cisco security update immediately and audit for any unauthorized admin account creation or configuration changes.
- SOC/IR — Act: Active exploitation of an edge management plane device warrants an assume-breach sweep — check for unexpected admin accounts, configuration modifications, or lateral movement originating from SD-WAN Manager nodes even before patching is confirmed complete.
- Leader — Plan: Confirm whether Cisco Catalyst SD-WAN Manager is in your environment and escalate it to the high-priority patching queue; active exploitation is confirmed but scope appears targeted rather than the systemic, board-level event that would require immediate leadership briefing.
- Signals: CVE-2026-76504 — CISA KEV: not listed, EPSS n/a, no public PoC found, reported by 2 collected sources
- Engineer — Act: VeloCloud Orchestrator On-Prem is actively exploited network management infrastructure — apply Arista’s released patches immediately and treat all unpatched VCO instances as potentially compromised.
- SOC/IR — Act: Active exploitation means systems may have been compromised before patches were available — sweep VCO On-Prem hosts for anomalous admin activity, lateral movement, and configuration changes since the zero-day window opened.
- Leader — Act: Actively exploited zero-day in SD-WAN management infrastructure warrants same-week action — confirm whether VCO On-Prem is deployed, verify the patch has been applied or is on an emergency timeline, and brief IT leadership on exposure status.
- Engineer — Act: Actively exploited CVSS 10.0 with a public PoC — if you run on-premises VeloCloud Orchestrator with certificate-based Edge authentication, apply Arista’s patch or available mitigations immediately and isolate the VCO management plane from untrusted networks while patching.
- SOC/IR — Act: Active exploitation of a network management appliance means you should assume potential compromise on affected systems; sweep VCO host logs for anomalous internal function invocations or unexpected outbound connections since September 22 and flag any certificate-authenticated VCO instances for immediate IR triage.
- Leader — Plan: Confirm with engineering whether the organization runs on-premises VeloCloud Orchestrator with certificate-based authentication; if so, escalate to engineering for priority patching this week given active exploitation of a maximum-severity flaw in a network control-plane component.
- Signals: CVE-2026-93952 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
- Engineer — Act: CVE-2026-16812 (CVSS 10.0) is CISA KEV-listed with a public PoC and confirmed active exploitation — patch on-premises VeloCloud Orchestrator to the vendor-fixed version immediately and treat any unpatched instance as potentially compromised.
- SOC/IR — Act: Active exploitation of this RCE means on-prem VCO hosts should be treated as assume-breach candidates; hunt for anomalous process execution or outbound connections originating from VeloCloud Orchestrator nodes and sweep for IOCs since the date public PoC became available.
- Leader — Act: Confirm whether the organization runs on-premises VeloCloud Orchestrator and if so escalate to an emergency patch cycle this week; a CVSS 10.0 SD-WAN orchestration flaw on the CISA KEV list under active exploitation is a board-question-level event for enterprises relying on it for network management.
- Signals: CVE-2026-16812 — CISA KEV: listed, EPSS n/a, public PoC on GitHub