# GreyNoise: Attack Surges Against Network Infrastructure Vendors Precede CVE Disclosure by a Median of 11 Days (Cisco CVE-2026-20127, Fortinet CVE-2026-24858, SonicWall CVE-2026-0400)

> GreyNoise analyzed 147.8 million sessions across 276 vendor-specific tags covering 18 network infrastructure vendors over 103 days and found 104 surge events, 68 of which preceded a vendor-matched CVE (33 vulnerabilities, 16 vendor families). Median lead time was 11 days; the earliest surge for Cisco CVE-2026-20127 was 39 days before disclosure, making pre-disclosure scanning surges a usable early-warning signal for patch prioritization.

- **Published:** 2026-10-30T00:18:01Z
- **Last reviewed:** 2026-10-30T00:18:01Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4782
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4782.png
- **ID:** TL-2026-4782
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 13 (3 shown free below)
- **CVEs:** CVE-2026-20127, CVE-2026-24858, CVE-2026-0400, CVE-2022-20775

## Description

GreyNoise's 'Ten Days Before Zero' study, summarized in the blog post 'The Internet Changes Before the Advisory Drops' (2026-04-20), measures whether internet-wide attacker activity against network edge vendors rises before the vendor publishes a CVE. The dataset covers 147.8 million sessions across 276 vendor-specific tags for 18 network infrastructure vendors over a 103-day window. GreyNoise identified 104 surge events; 68 preceded a vendor-matched CVE, spanning 33 vulnerabilities across 16 vendor families. Statistical testing was used to show the pattern exceeds coincidence.

Lead-time findings: the median lead time is 11 days; 49% of surges arrived within 10 days of disclosure and 78% within 21 days. Distributed surges averaged a 21.3-day lead time, while surges concentrated in a few hosting providers averaged 7.5 days. Session volume is the primary predictor; IP count alone is a weaker signal, but a simultaneous spike in volume and unique IPs extends lead time to around 21 days. 11 ASNs appeared across three or more vendor families and 4 attacker clusters were identified (the specific ASN numbers are not listed in the public blog or report summary).

Case studies: (1) Cisco CVE-2026-20127, a CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN Controller (vSmart) and Manager (vManage) disclosed 2026-02-25 and exploited as a zero-day since at least 2023 by the actor Cisco Talos tracks as UAT-8616; GreyNoise saw eight surges compressing from 39 days to 2 days before disclosure. Post-exploitation reported by Talos included adding a rogue peer, downgrading software to abuse CVE-2022-20775 for root, and persistent backdoors. CISA issued an emergency directive. (2) SonicWall CVE-2026-0400, a post-authentication format-string (CWE-134) denial-of-service in SonicOS on TZ-series firewalls, published 2026-02-24 and fixed in SonicOS 8.2.0-8009; GreyNoise saw six surges from 37 to 3 days before disclosure peaking at 69x median volume, and third-party reporting lists scanning spikes on January 18, January 30 and February 14. (3) Fortinet CVE-2026-24858, a CVSS 9.4 FortiCloud SSO authentication bypass via an alternate path (CWE-288) affecting FortiOS, FortiManager, FortiAnalyzer and FortiProxy, advisory published 2026-01-27 and added to CISA KEV; GreyNoise observed only one day of warning. Fortinet reported exploitation by two malicious FortiCloud accounts, which attackers used to download device configurations and create local admin accounts.

Defensive takeaway: pre-disclosure surge telemetry against a vendor's product tags should feed patch prioritization and staging, particularly for edge devices (SD-WAN, firewall, VPN). This record is research/early-warning intelligence; the IOCs below come from the Fortinet CVE-2026-24858 exploitation reporting, not from the GreyNoise study, which lists no IOCs. BeaconBeagle returned HTTP 404 (no beacon record) for 37.1.209.19 and 217.119.139.50.

## MITRE ATT&CK

- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1136.001 Local Account
- T1098 Account Manipulation
- T1601.002 Downgrade System Image
- T1602.002 Network Device Configuration Dump

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**FortiGate Local Admin Account Created with CVE-2026-24858 Post-Exploitation Username - Post-Exploitation** (`TL-2026-4782-SPL-002`)

Detects creation of a FortiGate local administrator whose name matches the usernames attackers created after exploiting CVE-2026-24858 (audit, backup, itadmin, secadmin, support, backupadmin, deploy, remoteadmin, security, svcadmin, system). Covers persistence through local account creation and account manipulation.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1136.001, T1098, T1078
- **Data sources:** Fortinet FortiGate event logs (index=netfw, sourcetype=fortinet:fortigate_event), CommonSecurityLog (Fortinet CEF)
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=netfw sourcetype=fortinet:fortigate_event cfgpath="system.admin" earliest=-24h
| where lower(action)="add" OR match(msg, "(?i)^add[ ]+system[.]admin")
| eval new_admin=lower(cfgobj)
| where match(new_admin, "^(audit|backup|itadmin|secadmin|support|backupadmin|deploy|remoteadmin|security|svcadmin|system)$")
| stats count min(_time) as first_seen max(_time) as last_seen values(user) as created_by values(srcip) as created_from values(ui) as ui by host new_admin
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let iocAdmins = dynamic(['audit','backup','itadmin','secadmin','support','backupadmin','deploy','remoteadmin','security','svcadmin','system']);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor =~ 'Fortinet'
| extend Raw = tolower(strcat(Activity, ' ', Message, ' ', AdditionalExtensions))
| where Raw contains 'system.admin'
| extend CfgObj = extract(@'cfgobj=.?([a-z0-9_.-]+)', 1, Raw)
| where CfgObj in (iocAdmins)
| project TimeGenerated, DeviceName, Activity, SourceUserName, SourceIP, CfgObj, Message
| order by TimeGenerated desc
```

### Sigma

```yaml
title: Fortinet FortiGate Admin Account Created with CVE-2026-24858 Post-Exploitation Username
id: c4e8a1d7-92b6-4f03-b5a8-6d1e0f3c7a29
status: experimental
description: Detects a new FortiGate local admin with one of the usernames created by attackers after exploiting the FortiCloud SSO authentication bypass CVE-2026-24858.
references:
  - https://www.bleepingcomputer.com/news/security/fortinet-blocks-exploited-forticloud-sso-zero-day-until-patch-is-ready/
  - https://arcticwolf.com/resources/blog-uk/cve-2026-24858-forticloud-sso-authentication-bypass-vulnerability-exploited/
author: Threadlinqs Team
date: 2026-10-30
tags:
  - attack.persistence
  - attack.t1136.001
  - attack.t1098
  - cve.2026-24858
logsource:
  category: firewall
  product: fortinet
detection:
  selection:
    cfgpath: 'system.admin'
    action: 'Add'
    cfgobj:
      - 'audit'
      - 'backup'
      - 'itadmin'
      - 'secadmin'
      - 'support'
      - 'backupadmin'
      - 'deploy'
      - 'remoteadmin'
      - 'security'
      - 'svcadmin'
      - 'system'
  condition: selection
falsepositives:
  - Administrators who legitimately provision a service account with one of these generic names
level: high
```

**Known false positives:**

- Legitimate provisioning of a generic-named admin or service account by the firewall team
- Automation or MSP tooling that creates a backup or support admin

**Tuning notes:** Correlate with a preceding FortiCloud SSO login (SPL-001) within 30 minutes to raise priority. Extend the name list with any additional usernames from your own incident findings. Verify cfgpath, cfgobj and action extractions against your FortiOS release. Exclude change windows tied to approved tickets.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Pre-Disclosure Scanning Surge Against Edge Firewall Management Ports (GreyNoise Early-Warning Pattern) - Exploitation (locked: unlock with TL Creds)
- Cisco SD-WAN Software Install, Activate or Reset via CLI (CVE-2022-20775 Downgrade Pattern) - Post-Exploitation (locked: unlock with TL Creds)
- Connections To or From CVE-2026-24858 Reported Exploitation IPs - C2 and Lateral Movement (locked: unlock with TL Creds)
- SonicWall SonicOS Format String Specifiers in Management Request (CVE-2026-0400) - Exploitation (locked: unlock with TL Creds)
- FortiGate Configuration Download or Backup Event (CVE-2026-24858 Post-Exploitation) - Post-Exploitation (locked: unlock with TL Creds)
- Cisco SD-WAN Controller Peer Connection Up from vManage or vSmart Peer Type (CVE-2026-20127 Rogue Peer) - C2 and Lateral Movement (locked: unlock with TL Creds)
- FortiCloud SSO Admin Login from Known CVE-2026-24858 Exploitation Account or Source IP - Exploitation (locked: unlock with TL Creds)
- Cisco Catalyst SD-WAN vmanage-admin Public-Key Login from Non-Internal Address (CVE-2026-20127, UAT-8616) - C2 and Lateral Movement (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 13)

Defanged, TLP:CLEAR.

- IP address: `104.28.244[.]115`
- IP address: `104.28.244[.]114`
- IP address: `104.28.212[.]114`

Full set of 13 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [The Internet Changes Before the Advisory Drops (GreyNoise)](https://www.greynoise.io/blog/the-internet-changes-before-the-advisory-drops)
- [Ten Days Before Zero (GreyNoise full report)](https://www.greynoise.io/resources/ten-days-before-zero)
- [Cisco Security Advisory cisco-sa-sdwan-rpa-EHchtZk](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk)
- [Cisco Talos: UAT-8616 SD-WAN](https://blog.talosintelligence.com/uat-8616-sd-wan/)
- [Help Net Security: Threat actor leveraged Cisco SD-WAN zero-day since 2023 (CVE-2026-20127)](https://helpnetsecurity.com/2026/02/25/cisco-sd-wan-zero-day-cve-2026-20127)
- [ACSC-led Cisco SD-WAN Hunt Guide](https://www.cyber.gov.au/sites/default/files/2026-02/ACSC-led%20Cisco%20SD-WAN%20Hunt%20Guide.pdf)
- [BleepingComputer: Fortinet blocks exploited FortiCloud SSO zero-day until patch is ready](https://www.bleepingcomputer.com/news/security/fortinet-blocks-exploited-forticloud-sso-zero-day-until-patch-is-ready/)
- [Arctic Wolf: CVE-2026-24858 FortiCloud SSO authentication bypass exploited](https://arcticwolf.com/resources/blog-uk/cve-2026-24858-forticloud-sso-authentication-bypass-vulnerability-exploited/)
- [Censys Advisory: Fortinet FortiCloud SSO Authentication Bypass CVE-2026-24858](https://censys.com/advisory/cve-2026-24858)
- [The Register: Fortinet unearths another critical bug as SSO accounts borked post-patch](https://www.theregister.com/2026/01/28/fortinet_forticloud_vuln/)
- [NVD: CVE-2026-0400](https://nvd.nist.gov/vuln/detail/cve-2026-0400)
- [SentinelOne Vulnerability Database: CVE-2026-0400](https://www.sentinelone.com/vulnerability-database/cve-2026-0400/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4782