IPv4 Address
Cisco Talos tracks active exploitation of CVE-2026-20182, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller and Manager, allowing remote attackers to obtain administrative privileges. The exploitation is attributed to UAT-8616, a sophisticated threat actor previously involved in similar attacks. Additionally, multiple threat clusters have been exploiting CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122 since March 2026, following public release of proof-of-concept code by ZeroZenX Labs. Post-compromise activities include deployment of various webshells, including XenShell, Godzilla, and Behinder variants, along with cryptocurrency miners, red team frameworks like S... | Shodan InternetDB; ports: 22, 80, 8000, 8080; tags: open-dir; CVEs: CVE-2025-6075, CVE-2026-4519, CVE-2022-0391, CVE-2020-29396, CVE-2025-13837; software: cpe:/o:linux:linux_kernel, cpe:/o:debian:debian_linux, cpe:/a:openbsd:openssh:8.4p1
No sightings recorded yet