Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
11 IOCs
Cisco Catalyst SD-WAN Manager Zero-Day Exploited to Gain Root Access
Excerpt
A sophisticated intrusion campaign targeting SD-WAN infrastructure at a service provider, culminating in the exploitation of a previously unknown vulnerability to achieve root-level system access. The zero-day, now tracked as CVE-2026-20245 , resides in the CLI of Cisco Catalyst SD-WAN Controllers and stems from the device’s file upload feature failing to properly filter malicious input data. Between late 2025 and January 2026, Mandiant observed multiple unauthorized…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →11 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 126.51.108.152 | High | Score 61/100 | First seen |
| IP | 45.32.38.160 | High | Score 61/100 | First seen |
| IP | 209.137.225.101 | High | Score 61/100 | First seen |
| IP | 153.186.231.233 | High | Score 61/100 | First seen |
| IP | 76.92.245.217 | High | Score 61/100 | First seen |
| CVE | CVE-2026-20245 | High | Score 78/100 | First seen |
| IP | 207.190.37.94 | High | Score 61/100 | First seen |
| IP | 23.245.7.178 | High | Score 61/100 | First seen |
| CVE | CVE-2026-20182 | High | Score 77/100 | First seen |
| IP | 167.179.79.189 | High | Score 61/100 | First seen |
| CVE | CVE-2026-20127 | High | Score 72/100 | First seen |
IOC Relationship Graph
Building graph…