UAT-8616
UAT-8616 is a Cisco Talos-tracked threat activity cluster described as a highly sophisticated cyber threat actor. Cisco linked the group with high confidence to active exploitation of Cisco Catalyst SD-WAN vulnerabilities, including CVE-2026-20127 and CVE-2026-20182, with evidence of activity dating back to at least 2023. The actor has targeted Cisco SD-WAN systems, including Catalyst SD-WAN Controller and Manager, and Cisco reporting states that it targets critical infrastructure sectors. Observed tradecraft includes exploiting authentication bypass flaws to gain unauthorized access to SD-WAN systems, creating rogue peer relationships, obtaining administrative or other high-privileged access, modifying NETCONF configurations, adding SSH keys for persistence, and escalating privileges to root. Cisco also reported that in previously detected attacks the actor downgraded software versions to exploit CVE-2022-20775 for root privilege escalation, then restored the original software version. Cisco reported that infrastructure used by UAT-8616 overlaps with Operational Relay Box networks monitored by Talos. Multiple reports in the provided content describe the group as an alleged China-nexus actor or note that ORB overlap is frequently associated with Chinese espionage, but the content also states Cisco did not specifically align UAT-8616 with a particular nation-state in its advisory. No other aliases or sub-groups are directly provided beyond UAT-8616.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
25 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated vulnerabilities
6 CVEs this actor has used in observed campaigns. 6 of them exploited in the wild.
It's also assessed to be similar to CVE-2026-20127, another case of authentication bypass impacting the same component. Both vulnerabilities have been exploited in the wild as zero-days, with a threat activity cluster dubbed UAT-8616 linked to the abuse of CVE-2026-20127 as far back as 2023.
In previously detected attacks, the group escalated their privileges to root by downgrading the software versions and exploiting an older privilege escalation vulnerability (CVE-2022-20775).
On May 14th, Cisco published an advisory detailing a critical authentication bypass vulnerability affecting Cisco Catalyst SD-WAN controller infrastructure. The vulnerability, tracked as CVE-2026-20182, is a peering authentication bypass between SD-WAN infrastructure components... Active exploitation has been confirmed in the wild, and CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
Cisco Talos researchers also warned that UAT-8616 and at least 10 other threat groups have chained together and achieved “widespread in-the-wild active exploitation of three vulnerabilities in unpatched Cisco Catalyst SD-WAN Infrastructure.” The company previously disclosed and released patches for the vulnerabilities — including CVE-2026-20122, CVE-2026-20128 and CVE-2026-20133 — in February.
Cisco Talos researchers also warned that UAT-8616 and at least 10 other threat groups have chained together and achieved “widespread in-the-wild active exploitation of three vulnerabilities in unpatched Cisco Catalyst SD-WAN Infrastructure.” The company previously disclosed and released patches for the vulnerabilities — including CVE-2026-20122, CVE-2026-20128 and CVE-2026-20133 — in February.
1 more CVE tied to this actor tracked in Mallory.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Linked to exploitation of the Cisco Catalyst SD-WAN Manager authentication bypass vulnerability CVE-2026-20127 as a zero-day.
Exploited a maximum-severity authentication bypass flaw in Cisco Catalyst SD-WAN Controller to gain unauthorized access to SD-WAN systems.
Targeting Cisco SD-WAN infrastructure and exploiting authentication bypass vulnerabilities in Cisco Catalyst SD-WAN Controller to gain administrative control of the network control plane.
Conducting ongoing zero-day exploitation against Cisco network edge products, including Catalyst SD-WAN Controller and Manager, and previously exploiting Cisco firewall and SD-WAN vulnerabilities over a multi-year period.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.