Act
archived
Cisco SD-WAN Manager Critical Auth Bypass Actively Exploited
- Engineer — Act: Patch Cisco Catalyst SD-WAN Manager to the fixed release immediately — Cisco confirms active exploitation of unauthenticated remote admin API access with no workaround available; delay is indefensible.
- SOC/IR — Act: Cisco confirms active exploitation, making this an assume-breach scenario for any org running SD-WAN Manager; hunt for unauthorized admin API calls and unexpected configuration changes on those devices since at least September 30.
- Leader — Act: Confirm this week whether your organization runs Cisco Catalyst SD-WAN Manager, verify the engineering team has a patch window scheduled, and be prepared to brief leadership given active exploitation of admin-level network management access.
- Signals: CVE-2026-76504 — CISA KEV: not listed, EPSS n/a, no public PoC found, reported by 2 collected sources
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.