Cisco says SD-WAN Manager zero

Feeds.4Sysops •IT News • September 30, 2026

Cisco has confirmed active exploitation of a critical Cisco Catalyst SD-WAN Manager authentication bypass that can hand attackers admin-level API access with no credentials. The flaw, tracked as CVE-2026-76504, has no workaround, affects exposed managers regardless of configuration, and needs immediate patching. It lands after another Cisco zero-day under active attack on the same site, but this one targets the SD-WAN control plane rather than ISE. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Authentication Bypass in Cisco Catalyst SD-WAN Manager Exploited On September 30, 2026, Cisco disclosed a critical vulnerability (CVE-2026-76504) in the Catalyst SD-WAN Manager that allows unauthenticated remote attackers to bypass authentication and gain admin-level access to the system. This flaw stems from improper handling of URI encoding in HTTP requests, enabling attackers to send crafted requests that skip authentication checks. The vulnerability affects all versions of Cisco Catalyst SD-WAN Manager prior to the patched releases. Cisco confirmed that the vulnerability has been actively exploited in the wild, prompting urgent patching recommendations. Organizations with internet-exposed instances of the SD-WAN Manager are particularly at risk. Cisco has provided indicators of compromise (IOCs) to help organizations detect potential exploitation. The CVSS score for this vulnerability is 9.8, classifying it as critical. Immediate action is required to mitigate risks associated with this vulnerability. 32 sources 80

Extracted Entities

Cisco says SD-WAN Manager zero

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (1)