<![CDATA[🔴 Critical: Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager]]>Cisco has disclosed a critical zero-day vulnerability in Cisco Catalyst SD-WAN Manager, the platform used to manage Cisco SD-WAN deployments, and warns that the flaw is already being exploited in the wild. The advisory was published on September 30.

Tracked as CVE-2026-76504, the vulnerability is an authentication bypass that could let a remote attacker with no login credentials interact with the Manager's API with the privileges of the admin user. In other words, successful exploitation grants unauthenticated administrative access to the management interface.

Key details:

  • Affected product: Cisco Catalyst SD-WAN Manager
  • Vulnerability type: Critical authentication bypass
  • Impact: Remote, unauthenticated attacker can use the Manager's API as the admin user
  • Exploitation status: Actively exploited in the wild
  • Fix: Fixed releases are available
  • Workaround: None — Cisco states there is no workaround

Because no workaround exists, applying the fixed releases is the only remediation path. Organizations running Catalyst SD-WAN Manager should prioritize patching, and given the active exploitation and the administrative-level access this flaw provides, they should also review their environments for signs of unauthorized API activity.

Source: The Hacker News

Has your organization already applied the fixed releases, or are you still assessing exposure to CVE-2026-76504?

]]>https://xploitlk.com/topic/523/critical-cisco-warns-of-attackers-exploiting-critical-authentication-bypass-in-sd-wan-managerRSS for NodeTue, 27 Oct 2026 10:13:19 GMTThu, 01 Oct 2026 00:30:18 GMT60