Malicious actors are exploiting a Cisco catalyst vulnerability.

Threat actors are now broadly exploiting the Cisco Catalyst SD‑WAN vulnerability, which was originally used as a zero‑day and chained with older flaw to bypass authentication and gain persistence. WatchTowr observed a surge in exploitation attempts from many unique IP addresses, with the largest spike on March 4. Cisco also confirmed exploitation of two additional SD‑WAN flaws indicating broader attacker interest. Any exposed SD‑WAN system is now considered potentially compromised due to growing opportunistic mass exploitation.

Read more:

https://www.securityweek.com/recent-cisco-catalyst-sd-wan-vulnerability-now-widely-exploited/