Skip to navigation

Threat reportThreat IntelligenceTL-2026-4782

GreyNoise: Attack Surges Against Network Infrastructure Vendors Precede CVE Disclosure by a Median of 11 Days (Cisco CVE-2026-20127, Fortinet CVE-2026-24858, SonicWall CVE-2026-0400)

mediumACTIVE

GreyNoise analyzed 147.8 million sessions across 276 vendor-specific tags covering 18 network infrastructure vendors over 103 days and found 104 surge events, 68 of which preceded a vendor-matched CVE (33 vulnerabilities, 16 vendor families). Median lead time was 11 days; the earliest surge for Cisco CVE-2026-20127 was 39 days before disclosure, making pre-disclosure scanning surges a usable early-warning signal for patch prioritization. First disclosed .

Key facts

IdentifiersTL-2026-4782, CVE-2026-20127, CVE-2026-24858, CVE-2026-0400, CVE-2022-20775
Also known asTen Days Before Zero, The Internet Changes Before the Advisory Drops
SeverityMEDIUM
First disclosed
Exploitation statusLinked CVE exploited in the wild; Listed in CISA KEV: CVE-2026-20127 (added ), CVE-2026-24858 (added ), CVE-2022-20775 (added )
EPSSCVE-2026-20127: 88.4% (99.7th percentile); CVE-2026-24858: 85.7% (99.7th percentile); CVE-2022-20775: 12.4% (96.1th percentile)
Affected productsCisco Catalyst SD-WAN Controller (vSmart) and Catalyst SD-WAN Manager (vManage); Fortinet FortiOS, FortiManager, FortiAnalyzer, FortiProxy (FortiCloud SSO); SonicWall SonicOS on TZ series (TZ80, TZ270, TZ270W, TZ280, TZ370, TZ370W, TZ380, TZ470, TZ470W, TZ480, TZ570, TZ570P, TZ570W, TZ580, TZ670, TZ680)
Weaknesses (CWE)CWE-134, CWE-288
MITRE ATT&CK techniquesT1078 Valid Accounts, T1098 Account Manipulation, T1136.001 Local Account, T1190 Exploit Public-Facing Application, T1595 Active Scanning, T1601.002 Downgrade System Image, T1602.002 Network Device Configuration Dump
MotivationUNKNOWN
Target sectorsgovernment administration, telecoms, technology, finance, enterprise
Target regionsGlobal
Detection rules9 (1 shown free)
Sources12 cited sources

Detection coverage

As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4782 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: FortiGate Local Admin Account Created with CVE-2026-24858 Post-Exploitation Username - Post-Exploitation

Detects creation of a FortiGate local administrator whose name matches the usernames attackers created after exploiting CVE-2026-24858 (audit, backup, itadmin, secadmin, support, backupadmin, deploy, remoteadmin, security, svcadmin, system). Covers persistence through local account creation and account manipulation.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1136.001, T1098, T1078
  • Data sources: Fortinet FortiGate event logs (index=netfw, sourcetype=fortinet:fortigate_event), CommonSecurityLog (Fortinet CEF)
  • Severity: high
  • Confidence: high

Splunk SPL

index=netfw sourcetype=fortinet:fortigate_event cfgpath="system.admin" earliest=-24h
| where lower(action)="add" OR match(msg, "(?i)^add[ ]+system[.]admin")
| eval new_admin=lower(cfgobj)
| where match(new_admin, "^(audit|backup|itadmin|secadmin|support|backupadmin|deploy|remoteadmin|security|svcadmin|system)$")
| stats count min(_time) as first_seen max(_time) as last_seen values(user) as created_by values(srcip) as created_from values(ui) as ui by host new_admin
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let iocAdmins = dynamic(['audit','backup','itadmin','secadmin','support','backupadmin','deploy','remoteadmin','security','svcadmin','system']);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor =~ 'Fortinet'
| extend Raw = tolower(strcat(Activity, ' ', Message, ' ', AdditionalExtensions))
| where Raw contains 'system.admin'
| extend CfgObj = extract(@'cfgobj=.?([a-z0-9_.-]+)', 1, Raw)
| where CfgObj in (iocAdmins)
| project TimeGenerated, DeviceName, Activity, SourceUserName, SourceIP, CfgObj, Message
| order by TimeGenerated desc

Sigma

title: Fortinet FortiGate Admin Account Created with CVE-2026-24858 Post-Exploitation Username
id: c4e8a1d7-92b6-4f03-b5a8-6d1e0f3c7a29
status: experimental
description: Detects a new FortiGate local admin with one of the usernames created by attackers after exploiting the FortiCloud SSO authentication bypass CVE-2026-24858.
references:
  - https://www.bleepingcomputer.com/news/security/fortinet-blocks-exploited-forticloud-sso-zero-day-until-patch-is-ready/
  - https://arcticwolf.com/resources/blog-uk/cve-2026-24858-forticloud-sso-authentication-bypass-vulnerability-exploited/
author: Threadlinqs Team
date: 2026-10-30
tags:
  - attack.persistence
  - attack.t1136.001
  - attack.t1098
  - cve.2026-24858
logsource:
  category: firewall
  product: fortinet
detection:
  selection:
    cfgpath: 'system.admin'
    action: 'Add'
    cfgobj:
      - 'audit'
      - 'backup'
      - 'itadmin'
      - 'secadmin'
      - 'support'
      - 'backupadmin'
      - 'deploy'
      - 'remoteadmin'
      - 'security'
      - 'svcadmin'
      - 'system'
  condition: selection
falsepositives:
  - Administrators who legitimately provision a service account with one of these generic names
level: high

Known false positives:

  • Legitimate provisioning of a generic-named admin or service account by the firewall team
  • Automation or MSP tooling that creates a backup or support admin

Tuning notes: Correlate with a preceding FortiCloud SSO login (SPL-001) within 30 minutes to raise priority. Extend the name list with any additional usernames from your own incident findings. Verify cfgpath, cfgobj and action extractions against your FortiOS release. Exclude change windows tied to approved tickets.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Pre-Disclosure Scanning Surge Against Edge Firewall Management Ports (GreyNoise Early-Warning Pattern) - Exploitation · unlock with TL Creds
  • Cisco SD-WAN Software Install, Activate or Reset via CLI (CVE-2022-20775 Downgrade Pattern) - Post-Exploitation · unlock with TL Creds
  • Connections To or From CVE-2026-24858 Reported Exploitation IPs - C2 and Lateral Movement · unlock with TL Creds
  • SonicWall SonicOS Format String Specifiers in Management Request (CVE-2026-0400) - Exploitation · unlock with TL Creds
  • FortiGate Configuration Download or Backup Event (CVE-2026-24858 Post-Exploitation) - Post-Exploitation · unlock with TL Creds
  • Cisco SD-WAN Controller Peer Connection Up from vManage or vSmart Peer Type (CVE-2026-20127 Rogue Peer) - C2 and Lateral Movement · unlock with TL Creds
  • FortiCloud SSO Admin Login from Known CVE-2026-24858 Exploitation Account or Source IP - Exploitation · unlock with TL Creds
  • Cisco Catalyst SD-WAN vmanage-admin Public-Key Login from Non-Internal Address (CVE-2026-20127, UAT-8616) - C2 and Lateral Movement · unlock with TL Creds

Indicators of compromise

As of 2026-10-30, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-4782.

Sample indicators (3 of 13)

  • IP address: 104.28.244[.]115
  • IP address: 104.28.244[.]114
  • IP address: 104.28.212[.]114

Defanged, TLP:CLEAR. Full set of 13 indicators: unlock with TL Creds.

13 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

GreyNoise's 'Ten Days Before Zero' study, summarized in the blog post 'The Internet Changes Before the Advisory Drops' (2026-04-20), measures whether internet-wide attacker activity against network edge vendors rises before the vendor publishes a CVE. The dataset covers 147.8 million sessions across 276 vendor-specific tags for 18 network infrastructure vendors over a 103-day window. GreyNoise identified 104 surge events; 68 preceded a vendor-matched CVE, spanning 33 vulnerabilities across 16 vendor families. Statistical testing was used to show the pattern exceeds coincidence.

Lead-time findings: the median lead time is 11 days; 49% of surges arrived within 10 days of disclosure and 78% within 21 days. Distributed surges averaged a 21.3-day lead time, while surges concentrated in a few hosting providers averaged 7.5 days. Session volume is the primary predictor; IP count alone is a weaker signal, but a simultaneous spike in volume and unique IPs extends lead time to around 21 days. 11 ASNs appeared across three or more vendor families and 4 attacker clusters were identified (the specific ASN numbers are not listed in the public blog or report summary).

Case studies: (1) Cisco CVE-2026-20127, a CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN Controller (vSmart) and Manager (vManage) disclosed 2026-02-25 and exploited as a zero-day since at least 2023 by the actor Cisco Talos tracks as UAT-8616; GreyNoise saw eight surges compressing from 39 days to 2 days before disclosure. Post-exploitation reported by Talos included adding a rogue peer, downgrading software to abuse CVE-2022-20775 for root, and persistent backdoors. CISA issued an emergency directive. (2) SonicWall CVE-2026-0400, a post-authentication format-string (CWE-134) denial-of-service in SonicOS on TZ-series firewalls, published 2026-02-24 and fixed in SonicOS 8.2.0-8009; GreyNoise saw six surges from 37 to 3 days before disclosure peaking at 69x median volume, and third-party reporting lists scanning spikes on January 18, January 30 and February 14. (3) Fortinet CVE-2026-24858, a CVSS 9.4 FortiCloud SSO authentication bypass via an alternate path (CWE-288) affecting FortiOS, FortiManager, FortiAnalyzer and FortiProxy, advisory published 2026-01-27 and added to CISA KEV; GreyNoise observed only one day of warning. Fortinet reported exploitation by two malicious FortiCloud accounts, which attackers used to download device configurations and create local admin accounts.

Defensive takeaway: pre-disclosure surge telemetry against a vendor's product tags should feed patch prioritization and staging, particularly for edge devices (SD-WAN, firewall, VPN). This record is research/early-warning intelligence; the IOCs below come from the Fortinet CVE-2026-24858 exploitation reporting, not from the GreyNoise study, which lists no IOCs. BeaconBeagle returned HTTP 404 (no beacon record) for 37.1.209.19 and 217.119.139.50.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Persistence

T1098 Account Manipulation; T1136.001 Local Account

Reconnaissance

T1595 Active Scanning

defense-impairment

T1601.002 Downgrade System Image

Collection

T1602.002 Network Device Configuration Dump

Remediation

Patches

  • Cisco Catalyst SD-WAN fixed releases per cisco-sa-sdwan-rpa-EHchtZk
  • Fortinet fixed firmware per the CVE-2026-24858 PSIRT advisory
  • SonicOS 8.2.0-8009 or later

Immediate actions

  • Patch Cisco Catalyst SD-WAN Controller/Manager for CVE-2026-20127 per Cisco advisory cisco-sa-sdwan-rpa-EHchtZk and follow the CISA emergency directive and ACSC hunt guide
  • Upgrade Fortinet FortiOS/FortiManager/FortiAnalyzer/FortiProxy to fixed releases for CVE-2026-24858 and audit for unexpected admin accounts and configuration downloads
  • Upgrade SonicWall TZ-series SonicOS to 8.2.0-8009 or later for CVE-2026-0400
  • Hunt for rogue SD-WAN peers, unexpected software downgrades and unauthorized local admin accounts

Workarounds

  • Disable FortiCloud SSO login on Fortinet devices until patched (disabled by default in factory settings)

Longer-term hardening

  • Ingest pre-disclosure scanning surge telemetry (for example GreyNoise vendor tags) into patch prioritization and staging workflows
  • Alert on session-volume and unique-IP spikes against the vendors in your edge inventory
  • Restrict management-plane exposure of SD-WAN controllers, firewalls and SSO integrations to trusted networks

Affected and fixed versions

  • Cisco — Catalyst SD-WAN Controller (vSmart) and Catalyst SD-WAN Manager (vManage)
    Vulnerable versions: On-prem and SD-WAN Cloud deployments prior to fixed release
    Fixed in: See cisco-sa-sdwan-rpa-EHchtZk
  • Fortinet — FortiOS, FortiManager, FortiAnalyzer, FortiProxy (FortiCloud SSO)
    Vulnerable versions: Releases prior to fixed firmware with FortiCloud SSO enabled
    Fixed in: See Fortinet PSIRT advisory for CVE-2026-24858
  • SonicWall — SonicOS on TZ series (TZ80, TZ270, TZ270W, TZ280, TZ370, TZ370W, TZ380, TZ470, TZ470W, TZ480, TZ570, TZ570P, TZ570W, TZ580, TZ670, TZ680)
    Vulnerable versions: Releases prior to 8.2.0-8009
    Fixed in: 8.2.0-8009

Timeline

  • First of three reported scanning spikes against SonicWall firewalls (Jan 18, Jan 30, Feb 14) preceding CVE-2026-0400 disclosure
  • Initial reports of compromised FortiGate firewalls via FortiCloud SSO abuse
  • Fortinet disabled the two malicious FortiCloud accounts used in exploitation
  • Fortinet globally disabled FortiCloud SSO
  • Fortinet published the CVE-2026-24858 advisory (CVSS 9.4) and restored SSO with server-side restrictions; GreyNoise observed only one day of pre-disclosure warning
  • CISA KEV remediation deadline for CVE-2026-24858; also the second reported SonicWall scanning spike
  • CVE-2026-0400 published to NVD; GreyNoise recorded six surges 37 to 3 days earlier, peaking at 69x median volume
  • Cisco disclosed CVE-2026-20127 (CVSS 10.0) exploited since at least 2023 by UAT-8616; GreyNoise saw eight surges from 39 to 2 days prior; CISA emergency directive issued
  • GreyNoise published 'The Internet Changes Before the Advisory Drops' (147.8M sessions, 104 surges, median 11-day lead)

Sources cited

Other reports on CVE-2026-20127

Other reports on CVE-2026-24858

Previous and next in threat intel

Further reading

Drafted by the Threadlinqs research pipeline from 12 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats