Reassess Telecom and Network Contracts After New Exploits Surface

What happened

Mandiant released technical details showing attackers exploited a Cisco Catalyst SD‑WAN command‑injection zero‑day to create rogue root accounts in vendor management consoles. The report links the privilege escalation to prior unauthorized peering and tenant-upload features, highlighting that the attack chain often involved chaining older bypasses to reach root. Watch for additional IoCs and supplier confirmations about certificate or prior-compromise reuse

Why the category manager should care

Treat SD‑WAN controllers and vendor consoles as high‑value assets; require supplier proof they’ve audited all management-plane access because these consoles can grant global control

Key facts

• Exploit chain escalated to root via crafted tenant upload
• Rogue SD‑WAN peering activity observed beginning in March
• Mandiant links CVE-2026-20245 exploitation to prior authentication bypass activity

What happened

Security firms reported active exploitation of a Cisco Unified Communications Manager SSRF flaw that can permit unauthenticated file writes and potential root access. Patches were published weeks earlier, but attackers are exploiting the window where appliances remain unpatched or configurations allow WebDialer features to be abused. Buyers should verify exposure and request mitigation artifacts from voice-platform suppliers

Why the category manager should care

Confirm UC platforms are patched and that suppliers can prove mitigation because voice systems have direct business-availability and safety implications

Key facts

• Active exploitation observed after vendor patch release
• Vulnerability enables unauthenticated file writes via WebDialer-enabled systems
• Fixes released in advisory with specific release-train patches cited

What happened

Symantec and CSO detail Mistic, a stealthy backdoor linked to an initial‑access broker that has been observed since April and is used to establish durable remote access sold to ransomware groups. The tool runs in memory and can execute code without writing to disk, which complicates detection and lengthens forensic work. Track IOC updates and prioritize memory forensics where IAB-linked activity is suspected

Why the category manager should care

Assume footholds created by IABs are long-lived; insist suppliers support memory-forensic capabilities and share IOCs promptly because disk-only approaches miss this tool

Key facts

• Mistic used in multiple sectors including insurance, education, IT, and professional services
• Operates in memory and supports file transfer and remote code execution
• Observed alongside ModeloRAT and linked to known initial-access broker activity

What happened

Microsoft’s DART found two unrelated threat actors operating simultaneously against the same unpatched SharePoint server, which masked detection and complicated response. The overlap required correlating identity, endpoint, and cloud telemetry to reconstruct full scope, increasing time to containment and forensic complexity. Buyers should validate telemetry correlation capabilities in supplier incident response offers

Why the category manager should care

Require suppliers to prove they can correlate multiple telemetry sources because overlapping intrusions obfuscate scope and delay remediation

Key facts

• Two distinct attack chains were active in the same environment
• Correlating identity, endpoint, and cloud telemetry revealed full scope
• DART used threat intelligence to separate artifact clusters for response

What happened

Meta paused an employee monitoring program after employees bypassed data protections and accessed restricted training data, revealing inadequate access controls around high‑risk telemetry used for AI training. The vendor closed the immediate hole within hours but the incident shows supplier projects that handle sensitive data can fail operational controls and create downstream legal and reputational exposure for customers. Procurement should treat such supplier programs as production secrets and demand stronger controls

Why the category manager should care

Treat supplier AI training and telemetry projects as high‑risk systems; demand role‑based access controls and auditable access logs because internal failures can expose sensitive data

Key facts

• Unauthorized employee access was identified and the hole was closed within hours
• Data included prompts, transcriptions, and private conversations used for AI training
• Analysts note policy and technical governance were not aligned in the program