Skip to content
Bulwark BlackBulwark Black LLC
Latest
Wasmtime Sandbox Escape: Patch the Engine Behind Your Wasm WorkloadsQuest Quanum Incident: Protect Patient Data While Keeping Orders MovingPulsar Token Bypass: Check Anonymous Fallback and Patch BrokersCisco Expressway Root RCE: Patch the Cluster and Check Service ReachabilityPulsar Manager Is Retired: Remove the Console and Recover Cluster CredentialsArista VCO Exploitation: Patch the Orchestrator, Review Every Portal RoleSafePay Warning: Prove Your Backups Can Survive an Administrator CompromiseTeamUpdraft Compromise: Check Every Connected WordPress Site for PersistenceRailway Secrets Incident: Rotate Credentials, Then Check What They Could ReachLiteLLM 1.107.0 Compromise: Rebuild the Environment, Recover the CredentialsGitLab Regex RCE: Patch the Server, Verify the Delivery ChaineMudhra CA Key Compromise: Check the Trust Stores Beyond Your BrowserPHP2Shell: Patch the Runtime Behind Your WebsitesTrusted Notifications, Untrusted Instructions: Close the Email Content Gap

IOC Passport

CVE-2026-20245

CVEArticle-derived observationCurrent reporting windowReported in 2 articlesWatch this →

A CVE identifier referenced in published reporting. It is vulnerability context, not a malicious indicator or feed verdict.

This value remains inside its 90-day contextual reporting window. Current reporting status is separate from verified-feed admission. Archive-cleared or archived does not mean clean, inactive, benign, remediated, resolved, or safe, and this lifecycle does not change current verified-feed admission.

Current verified-feed status

Checking live guard…

Article reporting and current malicious-feed admission are evaluated separately.

First reported
Last reported
Article count
2
Admission policy
Context only
Research lifecycle
Current

Article reporting history

These dates are report publication dates, not provider sightings or proof of malicious activity.

General CTI·Oct 3, 2026

Cisco SD-WAN Auth Bypass Shows Edge Control Planes Need Emergency Review

Cyber Security Blog·Jun 5, 2026

Cisco SD-WAN Zero-Day Shows Edge Controllers Need Compromise Review

Related indicators

Observables that appear alongside this one in the same reporting. Co-occurrence can suggest shared infrastructure, but it does not establish common ownership, campaign identity, or actor attribution.

CVE-2026-20127CVE-2026-2018220[.]12[.]7[.]120[.]12[.]7[.]220[.]12[.]8[.]220[.]15[.]4[.]420[.]15[.]4[.]520[.]15[.]5[.]220[.]15[.]5[.]320[.]15[.]6[.]120[.]18[.]2[.]220[.]18[.]3[.]120[.]18[.]4[.]120[.]9[.]10[.]120[.]9[.]9[.]120[.]9[.]9[.]226[.]1[.]1[.]126[.]1[.]1[.]226[.]1[.]2[.]1CVE-2026-20262CVE-2026-76504hxxps://sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuUsec[.]cloudapps[.]cisco[.]com
Browse all indicators →IOC Archive →Machine-readable feeds →Extract IOCs from text →

Newsletter

The House-Of-L Brief.

Two short reads a day on markets, cyber threats, AI, and geopolitics. A "why it matters" line on every story.

Double opt-in. One-click unsubscribe on every issue. We never share your address.