GreyNoise Detects Pre-Disclosure Targeting Surges for 33 CVEs, Including Cisco CVE-2026-20127

What Happened

GreyNoise sensors logged eight distinct surges of targeting traffic against Cisco’s CVE‑2026‑20127 before Cisco released its advisory. The first surge appeared 39 days prior, with each subsequent surge arriving closer to disclosure.

Impact

• Cisco CVE‑2026‑20127 – CVSS 10.0 zero‑day
• SonicWall CVE‑2026‑0400 – multiple surges, 37‑3 day compression
• Fortinet CVE‑2026‑24858 – CVSS 9.4 zero‑day, single‑day warning
• 33 CVEs across 16 vendor families, median lead time 11 days

Signal Indicators

Session volume spikes are the strongest early warning. IP count alone is weaker, but when both metrics spike simultaneously confidence rises and lead time can extend to 21 days.

Actionable Steps

• Subscribe to GreyNoise vendor‑specific tags for your infrastructure.
• Configure alerts for sudden increases in session volume or combined IP and session spikes.
• Implement real‑time blocklists for ASNs that appear in multiple vendor surges.
• Prioritize patching for CVEs with observed pre‑disclosure activity.
• Maintain a rapid response playbook that includes isolation and traffic monitoring for affected assets.

Key Takeaways

Pre‑disclosure targeting surges are common; monitoring session volume and ASN activity can provide a 10‑21 day warning window before a zero‑day is publicly disclosed.