Security updates have been released that patch a critical vulnerability in the Cisco Umbrella Virtual Appliance (VA), which if exploited, could allow unauthenticated attackers to steal sensitive administrator credentials, giving them complete access to on-premise virtual machines (VM). Cisco Umbrella is a cloud DNS security architecture which defends against attacks by using the virtual appliances as conditional DNS nodes that safely handle and authenticate DNS data. The flaw, tracked as CVE-2022-20773, is caused by the utilization of a static SSH host key, which an attacker could exploit by conducting a man-in-the-middle attack on an Umbrella VA SSH tunnel. Once the key is captured, the attacker can authenticate, allowing them to dig much deeper, learning administrator credentials which would allow them to lock out the actual users, and change device configurations to send data back to a location of their choosing, or reload the appliance to perform malicious tasks outside of its intended functionality. Although this vulnerability is critical, SSH is not enabled by default on Umbrella VA machines, meaning that the scale of the potential fallout is greatly reduced. Cisco urges all Umbrella VA administrators to upgrade to the latest stable patch immediately since there are no workarounds or mitigations other than disabling SSH entirely. Cisco has stated that there is currently no publicly available proof-of-concept (PoC) exploit, and there is also no evidence that this vulnerability has been successfully exploited in-the-wild. CTIX team members will continue to follow this vulnerability and will provide updates if needed.