Detect Cisco Catalyst SD-WAN Controller Authentication Bypass (CVE-2026-20182) in Microsoft Sentinel

let sdwan_management_ports = dynamic([443, 8443, 8080, 8888, 830]);
let suspicious_paths = dynamic(["/dataservice", "/api/", "/j_security_check", "/login", "/management"]);
union
(
  CommonSecurityLog
  | where DeviceVendor has_any ("Cisco") and DeviceProduct has_any ("SD-WAN", "vManage", "vSmart", "vBond")
  | where Activity has_any ("auth_bypass", "authentication failure", "unauthorized", "401", "403")
  | extend SourceIP = coalesce(SourceIP, DeviceAddress)
),
(
  W3CIISLog
  | where csUriStem has_any (suspicious_paths)
  | where scStatus in (200, 302) and csMethod in ("GET", "POST")
  | where csUriQuery has_any ("token=", "jwt=", "session=")
),
(
  AzureNetworkAnalytics_CL
  | where DestPort_d in (sdwan_management_ports)
  | where FlowStatus_s == "A"
  | where FlowType_s == "ExternalPublic"
),
(
  DeviceNetworkEvents
  | where RemotePort in (sdwan_management_ports)
  | where InitiatingProcessFileName in~ ("curl.exe", "python.exe", "python3", "wget", "powershell.exe")
  | where RemoteUrl has_any ("vmanage", "sdwan", "catalyst-sdwan")
)
| summarize
    EventCount = count(),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    UniqueSourceIPs = dcount(SourceIP)
  by bin(TimeGenerated, 5m), SourceIP, DestinationIP
| where EventCount > 5 or UniqueSourceIPs > 3
| extend
    Severity = "Critical",
    CVE = "CVE-2026-20182",
    Vendor = "Cisco",
    Product = "Catalyst SD-WAN"
| project TimeGenerated, SourceIP, DestinationIP, EventCount, UniqueSourceIPs, FirstSeen, LastSeen, Severity, CVE, Vendor, Product