Week of February 23, 2026: Cisco SD-WAN zero-day dates to 2023, and CISA orders emergency fixes

What mattered to security leaders in the week of February 23, 2026? On Wednesday, February 25, Cisco disclosed that an authentication bypass in its Catalyst SD-WAN Controller and Manager had been exploited as a zero-day, with Talos tracing the activity back to 2023, and CISA answered the same day with Emergency Directive 26-03 for federal agencies. Two new CISOs were named, at Clari + Salesloft and at AI infrastructure company Nscale, and UFP Technologies reported a material incident in an 8-K.

Cisco SD-WAN authentication bypass was exploited for about three years

Cisco said a highly sophisticated actor had exploited CVE-2026-20127, a peering authentication flaw in Catalyst SD-WAN Controller and Manager, which Australia's Cyber Security Centre reported to it. Attackers added a rogue peer and eventually gained root access for long-term persistence; Talos, which named the group UAT-8616, found evidence going back at least to 2023 and said the actor likely reached root by downgrading software and exploiting the older CVE-2022-20775. Customers were told to look for unauthorized peer connections. Network edge gear keeps turning up as the entry point for patient, well-resourced actors. (Help Net Security)

CISA issues Emergency Directive 26-03 during the DHS shutdown

CISA issued Emergency Directive 26-03, with supplemental hunt and hardening guidance, ordering federal civilian agencies to mitigate the Cisco SD-WAN vulnerabilities, which it judged an unacceptable risk. Acting Director Madhu Gottumukkala noted that the agency was operating through a multi-week shutdown of the Department of Homeland Security, with excepted staff working without pay. A joint Cisco SD-WAN Threat Hunt Guide was co-authored with the NSA and allied agencies. Private operators of the same Cisco gear can use the hunt guide even though the directive binds only federal agencies. (CISA)

Clari + Salesloft and Nscale appoint CISOs

SecurityWeek's industry moves column for the week of February 23 reported two CISO hires. Clari + Salesloft, the newly combined revenue platform, appointed Peter Liebert, formerly VP of cybersecurity at Vista Equity Partners and CISO for the State of California, to run a unified security program. AI infrastructure company Nscale named Latha Maripuri, previously CISO at Uber and Global CISO at News Corp. Merging two companies means merging two security programs, which is the job Liebert has been hired to do. Records: Liebert and Maripuri on CISO Tribune. (SecurityWeek)

UFP Technologies reports stolen or destroyed data in an 8-K

UFP Technologies filed an 8-K under Item 1.05 on February 24, saying it detected suspicious activity in its IT systems on or about February 14. The incident hit many but not all systems, disrupting functions such as billing and label making for customer deliveries, and some company data appears to have been stolen or destroyed. Backups and contingency plans kept operations running, and the company expects insurance to reimburse a significant share of direct costs. It had not yet determined whether personal information was taken. (SEC EDGAR)

UK ICO fines Reddit $19.5 million over children's data

The UK Information Commissioner's Office fined Reddit $19.5 million after finding it lacked a lawful basis to process the personal information of children under 13 because it applied no age assurance, and had not completed a data protection impact assessment on risks to children before January 2025. The regulator also told Reddit that the self-declared age checks it added in July 2025 are easy to bypass. Any consumer platform relying on a birthday field should treat this as a warning. (Help Net Security)

SANDWORM_MODE worm spreads through typosquatted npm packages

Socket researchers described SANDWORM_MODE, a campaign of 19 typosquatting npm packages that impersonate utilities including AI coding tools and supports-color, keep the expected functionality, and steal API keys, tokens, SSH keys and cryptocurrency wallet keys before spreading to other projects. A second stage waits 48 to 96 hours unless the loader detects a CI environment. Build pipelines with broad secrets are the prize here, which argues for short-lived CI credentials. (Help Net Security)