CISO Intelligence — 8 March 2026
Executive Summary
This week's threat landscape is shaped by three converging pressures: a critical Cisco SD-WAN zero-day actively exploited since 2023 (now under CISA Emergency Directive), a sharp uptick in Iranian-linked cyber activity following joint US-Israeli strikes on Iran, and a major industry report confirming that attackers have decisively shifted from breaking into systems to logging in with stolen credentials. Separately, new KEV additions across Apple, VMware, Hikvision, and Rockwell ICS platforms signal a broadening of the attack surface.
---
1. Cisco SD-WAN Zero-Day — CVSS 10.0 | CISA Emergency Directive Active
CVE-2026-20127 — a complete authentication bypass in Cisco Catalyst SD-WAN Controller and Manager — has been confirmed exploited in production environments for at least three years before its public disclosure. The flaw allows an unauthenticated remote attacker to obtain administrative access via the NETCONF interface, then pivot to full root control of SD-WAN fabric by chaining CVE-2022-20775. Five Eyes agencies have issued a joint advisory; CISA Emergency Directive 26-03 mandates immediate patching by all Federal Civilian Executive Branch agencies.
So what: Any organisation running Cisco Catalyst SD-WAN should treat this as a board-level operational risk today. The three-year exploitation window means existing deployments should be assumed compromised and investigated, not just patched. Forensic review of NETCONF access logs and SD-WAN peer configurations is advisable alongside the patch.
Action: Apply Cisco patches immediately. Follow CISA's Hunt & Hardening Guidance for Cisco SD-WAN Devices. Conduct a configuration audit to identify any unauthorised peers added to the SD-WAN fabric.
---
2. Iran Cyber Threat — Elevated Reconnaissance and DDoS Following Military Strikes
Following Operation Epic Fury (US) and Operation Roaring Lion (Israel) — joint strikes launched on 28 February 2026 — Iranian-aligned threat actors and hacktivist groups have significantly stepped up activity. CrowdStrike, Palo Alto Unit 42, and CloudSEK are all reporting active reconnaissance, DDoS campaigns, and preparation for potentially disruptive operations. Intelligence firms warn that every US and EU multinational firm is in scope; the targeting posture appears broader than previous Iranian campaigns.
So what: This is not a US-government-only concern. European organisations, particularly those in energy, financial services, and defence supply chains, should review their exposure to Iranian-attributed threat groups (APT33/Elfin, APT34/OilRig, and affiliated hacktivist fronts). The pattern is escalating from nuisance-level DDoS to pre-positioning for more serious disruption.
Action: Harden externally facing infrastructure. Review DDoS mitigation capacity. Ensure incident response plans account for hacktivist-style defacement alongside nation-state intrusion scenarios. Brief the board on geopolitical threat context.
---
3. Cloudflare 2026 Threat Report — The Shift to "Logging In"
Cloudflare's inaugural 2026 Threat Intelligence Report, drawing on data from a network blocking 230 billion threats daily, identifies a structural shift in attacker methodology: threat actors are increasingly bypassing technical exploitation in favour of credential abuse — phishing, credential stuffing, and identity-based access. AI is being weaponised both to generate attack infrastructure at scale and to accelerate vulnerability exploitation. DDoS attacks have reached unprecedented scale, with AI enabling more sophisticated targeting.
So what: The implications for identity and access management investment are significant. If perimeter-breaking is giving way to authenticated-session abuse, organisations that have deferred MFA rollouts, identity threat detection, or privileged access governance are now carrying measurable risk. This is a useful data point for conversations with boards about IAM programme maturity.
Action: Reassess identity hygiene: MFA coverage, phishing-resistant auth (passkeys/FIDO2), session monitoring, and lateral movement detection. Review whether current tooling can detect attacker-controlled authenticated sessions.
---
4. KEV Additions — Apple, VMware, Rockwell, Hikvision (5 March 2026)
CISA added five vulnerabilities to the KEV catalog on 5 March, all with a 26 March remediation deadline:
CVE-2023-41974 — Apple iOS/iPadOS — Use-After-Free — Kernel arbitrary code execution
CVE-2021-30952 — Apple Multiple (tvOS, macOS, Safari, watchOS) — Integer Overflow — Arbitrary code execution via web content
CVE-2023-43000 — Apple macOS/iOS/iPadOS/Safari — Use-After-Free — Memory corruption via web content
CVE-2022-20681 — Rockwell Multiple Products — Unprotected Credentials — Unauthorised ICS/OT controller access
CVE-2017-7921 — Hikvision Multiple Products — Improper Authentication — Privilege escalation on IP cameras
The Hikvision and Rockwell entries are particularly notable for OT/ICS environments. Hikvision CVE-2017-7921 is nearly a decade old, underscoring the persistence of unpatched legacy security cameras across enterprise and critical infrastructure sites.
So what: The Rockwell and Hikvision entries signal active OT/ICS targeting. Organisations that have not audited their IP camera estate or PLC network connectivity recently should do so.
Action: For federal and regulated organisations, mandatory patch deadline is 26 March. Audit Hikvision camera firmware versions. Review Rockwell Logix Designer deployment exposure. Accelerate Apple device patch cycles for managed fleets.
---
5. AI System Vulnerabilities — Claude Code RCE and Competitor Model Distillation
Check Point Research disclosed critical vulnerabilities in Anthropic's Claude Code (CVE-2025-59536) that allow remote code execution and API credential theft through malicious project configuration files. Anthropic has patched the issues. Separately, Anthropic has reported coordinated "distillation" activity by China-based AI firms — fraudulent accounts generating millions of API interactions to extract reasoning and workflow patterns for training competing models.
OpenAI's latest adversarial misuse report also documents an influence operation linked to Chinese law enforcement targeting Japan's prime minister — a reminder that AI platforms are now active terrain for both espionage and information operations.
So what: For organisations that have deployed AI coding assistants or integrated AI APIs into their development pipelines, supply chain risk from project-level configuration files is now an acknowledged attack vector. Treat AI tool configuration files with the same caution as source code secrets.
Action: Review AI development tool policies. Ensure API keys for AI services are stored in secrets managers, not project files. Monitor for unauthorised API usage patterns. Factor AI vendor security posture into supplier assessments.
---
6. Breach Roundup
Wynn Resorts (Hospitality/Gaming) — ShinyHunters accessed employee HR data; operations unaffected
UFP Technologies (Medical Device Manufacturing) — Cyberattack with data exfiltration and wipe; shipping/labelling disrupted
TWU Local 100 (Labour/Transit) — Qilin ransomware; 67,000 member records at risk
ManoMano (European E-Commerce) — Third-party portal breach; 3.8M customer records exposed (no passwords/payment data)
The UFP Technologies incident is worth noting given the medical device supply chain implications. The data wipe suggests a destructive component alongside the exfiltration, which may indicate geopolitical motivation or deliberate obfuscation of the attack timeline.
---
Watching
Roundcube Webmail — CVE-2025-49113 (post-auth RCE) and CVE-2025-68461 (unauthenticated XSS) now confirmed in-the-wild. Organisations running Roundcube, particularly in cPanel environments, should patch or restrict access immediately.
SolarWinds Web Help Desk — Pre-auth RCE chain (CVE-2025-40552, CVE-2025-40554, CVE-2025-40553) published. Patch exposed on-premises instances.
Qualcomm Chipsets — CVE-2026-21385 (memory corruption) added to KEV 3 March; due date 24 March.
VMware Aria Operations — CVE-2026-22719 (unauthenticated command injection) added to KEV 3 March.
---
For the Board
This week's single most actionable message: if your organisation uses Cisco Catalyst SD-WAN, assume it has been compromised and investigate while patching. The three-year exploitation window for CVE-2026-20127 means existing deployments are not simply vulnerable — they have been accessible to sophisticated threat actors since at least 2023. This is not a routine patch-and-move-on situation.
The broader strategic signal — confirmed by Cloudflare's annual report — is that identity and access management is now the primary line of defence for most organisations. Investments in IAM, phishing-resistant MFA, and identity threat detection have measurably better return than equivalent spend on perimeter security in the current threat environment.