Skip to content
Bulwark BlackBulwark Black LLC
Latest
Cisco Expressway Root RCE: Patch the Cluster and Check Service ReachabilityPulsar Manager Is Retired: Remove the Console and Recover Cluster CredentialsArista VCO Exploitation: Patch the Orchestrator, Review Every Portal RoleSafePay Warning: Prove Your Backups Can Survive an Administrator CompromiseTeamUpdraft Compromise: Check Every Connected WordPress Site for PersistenceRailway Secrets Incident: Rotate Credentials, Then Check What They Could ReachLiteLLM 1.107.0 Compromise: Rebuild the Environment, Recover the CredentialsGitLab Regex RCE: Patch the Server, Verify the Delivery ChaineMudhra CA Key Compromise: Check the Trust Stores Beyond Your BrowserPHP2Shell: Patch the Runtime Behind Your WebsitesTrusted Notifications, Untrusted Instructions: Close the Email Content GapBRONZE SANDCASTLE: Hunt the DLL Load Chain, Not the Trusted ExecutableOne Stolen Identity, Several SaaS Platforms: Respond Beyond the MailboxSiemens Software Center ClickFix Attacks: Hunt Beyond the Trusted Signature

IOC Passport

sec[.]cloudapps[.]cisco[.]com

DomainArticle-derived observationCurrent reporting windowReported in 2 articlesWatch this →

A domain extracted from published reporting. It may be infrastructure, a cited service, or a candidate indicator; check current feed admission before blocking. Shown defanged for safe viewing; use Copy live value for the functional form.

This value remains inside its 30-day domain/URL reporting window. Current reporting status is separate from verified-feed admission. Archive-cleared or archived does not mean clean, inactive, benign, remediated, resolved, or safe, and this lifecycle does not change current verified-feed admission.

Current verified-feed status

Checking live guard…

Article reporting and current malicious-feed admission are evaluated separately.

First reported
Last reported
Article count
2
Admission policy
bulwark-exact-malicious-v2
Research lifecycle
Current

Article reporting history

These dates are report publication dates, not provider sightings or proof of malicious activity.

General CTI·Oct 23, 2026

Cisco Expressway Root RCE: Patch the Cluster and Check Service Reachability

General CTI·Oct 3, 2026

Cisco SD-WAN Auth Bypass Shows Edge Control Planes Need Emergency Review

Related indicators

Observables that appear alongside this one in the same reporting. Co-occurrence can suggest shared infrastructure, but it does not establish common ownership, campaign identity, or actor attribution.

20[.]12[.]8[.]220[.]15[.]6[.]120[.]18[.]4[.]120[.]9[.]10[.]126[.]1[.]2[.]1CVE-2026-20127CVE-2026-20182CVE-2026-20245CVE-2026-20262CVE-2026-76466CVE-2026-76504hxxps://sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuUhxxps://sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t
Browse all indicators →IOC Archive →Machine-readable feeds →Extract IOCs from text →

Newsletter

The House-Of-L Brief.

Two short reads a day on markets, cyber threats, AI, and geopolitics. A "why it matters" line on every story.

Double opt-in. One-click unsubscribe on every issue. We never share your address.