Active exploitation of Cisco Catalyst SD-WAN by UAT-8616

Cisco Talos reports active exploitation of CVE-2026-20127 in Cisco Catalyst SD-WAN Controller by a highly sophisticated actor dubbed UAT-8616, with evidence of persistent access since 2023 including root escalation via version downgrade and follow-on exploitation of CVE-2022-20775; the advisory includes hunting guidance, sample log indicators, IOC types (unauthorized peers, SSH key artifacts, log tampering), and mitigation recommendations.