🔴 Critical: Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager
-
Cisco has disclosed a critical zero-day vulnerability in Cisco Catalyst SD-WAN Manager, the platform used to manage Cisco SD-WAN deployments, and warns that the flaw is already being exploited in the wild. The advisory was published on September 30.
Tracked as CVE-2026-76504, the vulnerability is an authentication bypass that could let a remote attacker with no login credentials interact with the Manager's API with the privileges of the admin user. In other words, successful exploitation grants unauthenticated administrative access to the management interface.
Key details:
- Affected product: Cisco Catalyst SD-WAN Manager
- Vulnerability type: Critical authentication bypass
- Impact: Remote, unauthenticated attacker can use the Manager's API as the admin user
- Exploitation status: Actively exploited in the wild
- Fix: Fixed releases are available
- Workaround: None — Cisco states there is no workaround
Because no workaround exists, applying the fixed releases is the only remediation path. Organizations running Catalyst SD-WAN Manager should prioritize patching, and given the active exploitation and the administrative-level access this flaw provides, they should also review their environments for signs of unauthorized API activity.
Source: The Hacker News
Has your organization already applied the fixed releases, or are you still assessing exposure to CVE-2026-76504?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login