Cisco Catalyst SD-WAN Manager Privileged API Abuse (CVE-2026-20122)

let SdwanManagerHosts = dynamic(["sdwan-manager", "vmanage"]);
let PrivilegedApiPaths = dynamic(["/dataservice/admin", "/dataservice/system", "/dataservice/device/action", "/dataservice/template", "/dataservice/settings/configuration", "/dataservice/certificate", "/dataservice/aaa"]);
let SuspiciousStatusCodes = dynamic([200, 201, 204]);
let LookbackWindow = 1h;
union
(
    CommonSecurityLog
    | where TimeGenerated >= ago(LookbackWindow)
    | where DeviceVendor =~ "Cisco" and DeviceProduct has_any ("SD-WAN", "vManage", "Catalyst SD-WAN")
    | where RequestURL has_any (PrivilegedApiPaths)
    | where RequestMethod in ("POST", "PUT", "DELETE", "PATCH")
    | where toint(EventOutcome) in (SuspiciousStatusCodes)
    | extend SourceIP = SourceIP, RequestedAPI = RequestURL, HttpMethod = RequestMethod
    | project TimeGenerated, SourceIP, DestinationIP, RequestedAPI, HttpMethod, EventOutcome, Message, DeviceAction
),
(
    AzureDiagnostics
    | where TimeGenerated >= ago(LookbackWindow)
    | where Category =~ "ApplicationGatewayAccessLog" or ResourceType =~ "APPLICATIONGATEWAYS"
    | where requestUri_s has_any (PrivilegedApiPaths)
    | where httpMethod_s in ("POST", "PUT", "DELETE", "PATCH")
    | where httpStatus_d in (200, 201, 204)
    | extend SourceIP = clientIP_s, RequestedAPI = requestUri_s, HttpMethod = httpMethod_s
    | project TimeGenerated, SourceIP, RequestedAPI, HttpMethod, httpStatus_d, host_s
)
| summarize
    RequestCount = count(),
    UniqueAPIs = dcount(RequestedAPI),
    APIsAccessed = make_set(RequestedAPI, 20),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
  by SourceIP, HttpMethod
| where RequestCount >= 3 or UniqueAPIs >= 2
| extend RiskScore = case(
    UniqueAPIs >= 4, "Critical",
    UniqueAPIs >= 2, "High",
    RequestCount >= 10, "High",
    "Medium"
  )
| sort by UniqueAPIs desc, RequestCount desc

index=network sourcetype IN ("cisco:sdwan", "cisco:vmanage", "cisco:sdwan:audit", "pan:traffic", "cisco:asa")
| eval api_path=coalesce(uri, url, request_uri, cs_uri_stem)
| eval http_method=coalesce(method, http_method, cs_method)
| eval src_ip=coalesce(src_ip, c_ip, src, clientip)
| eval http_status=coalesce(status, http_status_code, sc_status)
| where match(api_path, "(?i)/dataservice/(admin|system|device/action|template|settings/configuration|certificate|aaa)")
| where http_method IN ("POST", "PUT", "DELETE", "PATCH")
| where http_status IN ("200", "201", "204")
| bucket _time span=10m
| stats
    count AS request_count,
    dc(api_path) AS unique_apis,
    values(api_path) AS apis_accessed,
    values(http_method) AS methods_used,
    min(_time) AS first_seen,
    max(_time) AS last_seen
  BY src_ip, _time
| where request_count >= 3 OR unique_apis >= 2
| eval risk_score=case(
    unique_apis >= 4, "Critical",
    unique_apis >= 2, "High",
    request_count >= 10, "High",
    true(), "Medium"
  )
| eval alert_title="CVE-2026-20122: Cisco SD-WAN Manager Privileged API Abuse"
| table _time, src_ip, request_count, unique_apis, apis_accessed, methods_used, risk_score, first_seen, last_seen
| sort - unique_apis, - request_count

sequence by source.ip with maxspan=5m
  [network where
    destination.port in (443, 8443, 8080) and
    url.path : ("/dataservice/admin*", "/dataservice/system*", "/dataservice/device/action*", "/dataservice/template*", "/dataservice/settings/configuration*", "/dataservice/certificate*", "/dataservice/aaa*") and
    http.request.method in ("POST", "PUT", "DELETE", "PATCH") and
    http.response.status_code in (200, 201, 204)
  ] with runs=3

SELECT
  sourceip,
  destinationip,
  URL,
  METHOD,
  STATUSCODE,
  COUNT(*) AS request_count,
  COUNT(DISTINCT URL) AS unique_api_paths,
  MIN(starttime) AS first_seen,
  MAX(starttime) AS last_seen
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) ILIKE '%cisco%sd-wan%'
  OR LOGSOURCETYPENAME(devicetype) ILIKE '%vmanage%'
  OR LOGSOURCETYPENAME(devicetype) ILIKE '%catalyst sd-wan%'
AND (
  URL ILIKE '/dataservice/admin%'
  OR URL ILIKE '/dataservice/system%'
  OR URL ILIKE '/dataservice/device/action%'
  OR URL ILIKE '/dataservice/template%'
  OR URL ILIKE '/dataservice/settings/configuration%'
  OR URL ILIKE '/dataservice/certificate%'
  OR URL ILIKE '/dataservice/aaa%'
)
AND METHOD IN ('POST', 'PUT', 'DELETE', 'PATCH')
AND STATUSCODE IN ('200', '201', '204')
AND starttime > NOW() - 3600000
GROUP BY sourceip, destinationip, URL, METHOD, STATUSCODE
HAVING request_count >= 3 OR unique_api_paths >= 2
ORDER BY unique_api_paths DESC, request_count DESC

_sourceCategory="cisco/sdwan" OR _sourceCategory="cisco/vmanage" OR _sourceCategory="network/sdwan"
| parse regex "(?P<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" nodrop
| parse regex "(?P<method>GET|POST|PUT|DELETE|PATCH|OPTIONS) (?P<api_path>/dataservice/[^\s]+)" nodrop
| parse regex "HTTP/[\d\.]+\" (?P<status_code>\d{3})" nodrop
| where api_path matches "/dataservice/admin*"
  OR api_path matches "/dataservice/system*"
  OR api_path matches "/dataservice/device/action*"
  OR api_path matches "/dataservice/template*"
  OR api_path matches "/dataservice/settings/configuration*"
  OR api_path matches "/dataservice/certificate*"
  OR api_path matches "/dataservice/aaa*"
| where method in ("POST", "PUT", "DELETE", "PATCH")
| where status_code in ("200", "201", "204")
| timeslice 10m
| count as request_count, dcount(api_path) as unique_api_paths by src_ip, _timeslice
| where request_count >= 3 or unique_api_paths >= 2
| sort by unique_api_paths desc, request_count desc
| fields _timeslice, src_ip, request_count, unique_api_paths

rule cisco_sdwan_privileged_api_abuse_cve_2026_20122 {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects exploitation of CVE-2026-20122 via unauthorized privileged API access on Cisco Catalyst SD-WAN Manager"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v"
    cve = "CVE-2026-20122"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method in ("POST", "PUT", "DELETE", "PATCH")
    $e.network.http.response_code in (200, 201, 204)
    (
      re.regex($e.network.http.request_url, `/dataservice/admin`) or
      re.regex($e.network.http.request_url, `/dataservice/system`) or
      re.regex($e.network.http.request_url, `/dataservice/device/action`) or
      re.regex($e.network.http.request_url, `/dataservice/template`) or
      re.regex($e.network.http.request_url, `/dataservice/settings/configuration`) or
      re.regex($e.network.http.request_url, `/dataservice/certificate`) or
      re.regex($e.network.http.request_url, `/dataservice/aaa`)
    )
    $src_ip = $e.principal.ip

  match:
    $src_ip over 10m

  condition:
    #e >= 3
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=NetworkReceiveAcceptIP4
| TargetPort in (443, 8443, 8080)
| HttpMethod in ("POST", "PUT", "DELETE", "PATCH")
| HttpPath = /\/dataservice\/(admin|system|device\/action|template|settings\/configuration|certificate|aaa)/
| HttpStatus in ("200", "201", "204")
| groupBy([RemoteAddressIP4, LocalAddressIP4, HttpPath, HttpMethod], function=[
    count(aid, as=request_count),
    countDistinct(HttpPath, as=unique_paths),
    min(timestamp, as=first_seen),
    max(timestamp, as=last_seen),
    collect(HttpPath, as=paths_list, limit=20)
  ])
| request_count >= 3 OR unique_paths >= 2
| eval risk_level=if(unique_paths >= 4, "Critical", if(unique_paths >= 2, "High", "Medium"))
| sort(unique_paths, order=desc)
| sort(request_count, order=desc)