TeamTNT Targeting AWS, Alibaba
blog.talosintelligence.com · 21 Apr 2022 · Licence: not cleared; local research copy only
CVEs this report names
3 CVEs- CVE-2026-20182Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityCisco · Catalyst SD-WANKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing Application4 reports91.8%Top 0.18%83.9priority
- CVE-2025-20333Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow…Cisco · Secure Firewall Adaptive Security Appliance and Secure Firewall Threat DefenseKEVPublic exploitCritical · 9.9T1133External Remote ServicesT1059Command and Scripting Interpreter5 reports71.2%Top 0.59%79.8priority
- CVE-2025-20362Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization…Cisco · Secure Firewall Adaptive Security Appliance and Secure Firewall Threat DefenseKEVPublic exploitHigh · 8.6T1190Exploit Public-Facing ApplicationT1499.004Application or System Exploitation5 reports87.1%Top 0.25%79.0priority
Where it names them
CVE-2026-20182 Original (opens in a new tab) ↗
Cisco Talos is tracking the active exploitation of CVE-2026-20182, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage.
CVE-2025-20333 Original (opens in a new tab) ↗
UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices.
CVE-2025-20362 Original (opens in a new tab) ↗
UAT-4356 exploited n-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) to gain unauthorized access to vulnerable devices.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.