Salt Typhoon SD-WAN Attack: Zero-Day Plus Firmware Downgrade Chain by Chinese State APT

Cisco Talos disclosed on February 25, 2026, that a Chinese state-sponsored threat actor tracked as **UAT-8616** (also known as Salt Typhoon by industry and RedMike by Microsoft) had been exploiting a critical zero-day vulnerability in Cisco Catalyst SD-WAN infrastructure. ## The Attack Chain **Step 1: Zero-day exploitation.** CVE-2026-20127 (CVSS 10.0, unauthenticated) — a peering authentication bypass in the SD-WAN control plane. The attacker joins the victim's SD-WAN fabric as a fake branch office, gaining trusted network access without any credentials. **Step 2: Firmware downgrade.** Once inside the fabric, the attacker downgrades the SD-WAN appliance firmware to a version vulnerable to CVE-2022-20775, a 2022-era path traversal vulnerability that enables privilege escalation to root. **Step 3: Root escalation.** Using the reintroduced 2022 vulnerability on the downgraded firmware, the attacker escalates from network-level access to full root control of the SD-WAN appliance. **Step 4: Forensic cleanup.** The attacker re-upgrades the firmware back to the original version, removing evidence of the downgrade. Standard forensic analysis checking firmware version would show the expected software — the downgrade-upgrade cycle is invisible without deep analysis of firmware modification timestamps. ## Operational Duration The campaign ran for at least three years (since 2023) before detection. The combination of a zero-day entry point and active forensic cleanup made the intrusion exceptionally difficult to identify. ## Response Five Eyes intelligence partners issued coordinated emergency directives following the disclosure. The attack chain is notable for its sophistication: chaining a zero-day with a firmware manipulation technique that exploits the trust model of SD-WAN fabrics, where branch appliances are assumed to be legitimate once they successfully peer. ## Broader Significance The firmware downgrade technique — reintroducing patched vulnerabilities by rolling back software versions — represents an evolution in persistent access methodology. Organizations that verify only the current firmware version, not the firmware modification history, would miss this class of attack entirely. The technique is applicable to any network appliance that supports remote firmware management.