Volt Typhoon 'Silent Train' zero-day exploitation of SD-WAN and IT-management platforms (Cisco Catalyst SD-WAN)
Credible reporting attributes active exploitation of these zero-days to Volt Typhoon, a nation-state actor targeting edge and management infrastructure.
A Reddit summary of Lumen Black Lotus Labs research, corroborated by SecurityWeek, BleepingComputer and SecurityAffairs, attributes exploitation of at least four zero-days in edge and IT-management platforms to China-linked Volt Typhoon, which routes attacks through a rotating relay network ('Silent Train') of compromised VPS and SOHO/IoT gear. Named affected products and fixed builds include Cisco Catalyst SD-WAN (20.9.8.2/20.12.5.3/20.12.6.1/20.15.4.2/20.18.2.1), VeloCloud Orchestrator (5.2.3.14/6.1.3.4/6.4.2.4/7.0.0.1), N-able N-central (2025.3.1 / 2024.6 HF2), Versa Director (22.1.4+) and Quest KACE SMA (October 2025 updates). Specific CVEs and per-product technical detail are not stated in the post.
Affected: Cisco Catalyst SD-WAN before 20.9.8.2 / 20.12.5.3 / 20.12.6.1 / 20.15.4.2 / 20.18.2.1
How to Test
Inventory all VeloCloud Orchestrator, Catalyst SD-WAN Controller/Manager/Validator, N-able N-central, Versa Director and KACE SMA instances (including MSP-operated) and compare installed builds against the fixed versions listed; review management-plane access logs for anomalous sessions originating from relay/VPS and SOHO IP ranges.
How to Patch
Apply the vendor fixed builds for each product and isolate the management interfaces from the internet.