Breaking the silence
blog.talosintelligence.com · 8 Dec 2022 · Licence: not cleared; local research copy only
CVEs this report names
4 CVEs- CVE-2026-20182Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityCisco · Catalyst SD-WANKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing Application4 reports91.8%Top 0.18%83.9priority
- CVE-2022-31199Netwrix Auditor Insecure Object Deserialization VulnerabilityNetwrix · AuditorKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report36.0%Top 1.5%83.4priority
- CVE-2025-20333Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow…Cisco · Secure Firewall Adaptive Security Appliance and Secure Firewall Threat DefenseKEVPublic exploitCritical · 9.9T1133External Remote ServicesT1059Command and Scripting Interpreter5 reports71.2%Top 0.59%79.8priority
- CVE-2025-20362Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization…Cisco · Secure Firewall Adaptive Security Appliance and Secure Firewall Threat DefenseKEVPublic exploitHigh · 8.6T1190Exploit Public-Facing ApplicationT1499.004Application or System Exploitation5 reports87.1%Top 0.25%79.0priority
Where it names them
CVE-2026-20182 Original (opens in a new tab) ↗
Cisco Talos is tracking the active exploitation of CVE-2026-20182, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage.
CVE-2022-31199 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
Netwrix vulnerability (CVE-2022-31199) based delivery
Because multiple of these events occurred in the same timeframe on unrelated organizations, we believe with high confidence that these events are the result of the exploitation of a vulnerability in Netwrix Auditor (CVE-2022-31199) that was made public in July 2022 by Bishop Fox.
CVE-2025-20333 Original (opens in a new tab) ↗
UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices.
CVE-2025-20362 Original (opens in a new tab) ↗
UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.