Cisco Talos researchers identified a new threat group, UAT-11473, exploiting a maximum-severity authentication-bypass vulnerability in Cisco Catalyst SD-WAN Controllers and Managers, patched in February 2026, to install a custom malware framework called KeyDrift. The attacks targeted space and satellite services, defense and aerospace firms, and policy research organizations, aiming to steal encryption keys and control-plane traffic. KeyDrift comprises two components, PolyFlame and LittleFilch, which Talos says are under active development with new evasion techniques.
bleepingcomputer.com
· 2026-10-29
Arista Networks has issued security updates for a critical zero-day, CVE-2026-114625, affecting on-premises VeloCloud Orchestrator deployments. The flaw lets authenticated users with basic privileges exploit a low-complexity SQL injection to escalate to 'superuser operator' access without user interaction, and Arista says it has already patched its own hosted VCO instances on versions 5.2.3.18+, 6.1.3.10+, and 6.4.2.12+.
bleepingcomputer.com
· 2026-10-22
Ranet3 is a new SD-WAN tool that builds a mesh network using only standard protocols: IKEv2 and ESP for IPsec tunnels, Babel for routing, and SRv6 for segment routing. It is designed to interoperate with existing routers and switches like strongSwan and BIRD rather than requiring a proprietary agent, and it continuously measures round-trip time on each link to route traffic along the fastest path, including through intermediate relay nodes when that beats a direct connection.
ranet3.com
· 2026-10-18
Cisco has released fixes for a critical zero-day, CVE-2026-76504, in its Catalyst SD-WAN Manager software that attackers are already exploiting to gain unauthenticated admin access. The flaw stems from improper URI encoding handling that lets crafted HTTP requests bypass authentication on a specific API endpoint. Cisco says it learned of active exploitation in September 2026 and is urging customers to upgrade immediately.
bleepingcomputer.com
· 2026-09-30
Secure Access Service Edge (SASE) combines software-defined networking, threat prevention, access control and application security into a single cloud-delivered platform managed through one interface. It relies on globally distributed Points of Presence to enforce security and networking close to users, and typically begins deployment with SD-WAN, which intelligently routes traffic across MPLS, broadband, LTE and 5G links before organizations layer zero-trust security on top.
darkreading.com
· 2026-09-23
Arista Networks has issued patches for CVE-2026-93952, a maximum-severity flaw in on-premises deployments of VeloCloud Orchestrator, the centralized management platform for VeloCloud SD-WANs. The bug, an improper input validation issue affecting setups using certificate-based authentication between edge devices and the orchestrator, lets remote attackers gain privileged internal access without credentials or user interaction, and Arista says it is already being exploited in the wild.
bleepingcomputer.com
· 2026-09-23
GoKawiil