Multiple Hacker Groups Exploit Cisco SD-WAN Flaws to Deploy XMRig Cryptominer

Cisco Catalyst SD-WAN is an enterprise networking system that connects branch offices, data centers and cloud services. A compromised device could allow attackers to gain further control over critical traffic. Public proofs of concept are available for several high-risk flaws involved in the attacks, lowering the barrier to exploitation and heightening concern over their use in the wild.

Cisco patched the vulnerabilities in February 2026 but recently confirmed that multiple hacker groups had launched attacks. After gaining access to devices, the attackers deployed web shells, executed unauthorized commands, and installed the XMRig cryptominer and various data-stealing tools. Cisco urged customers to update as soon as possible. It has not disclosed the number of victims or the amount of losses.