Act
archived
Cisco Catalyst SD-WAN Manager zero-day exploited, patch available
- Engineer — Act: Actively exploited privilege escalation to admin in Cisco Catalyst SD-WAN Manager with patches released; apply the Cisco security update immediately and audit for any unauthorized admin account creation or configuration changes.
- SOC/IR — Act: Active exploitation of an edge management plane device warrants an assume-breach sweep — check for unexpected admin accounts, configuration modifications, or lateral movement originating from SD-WAN Manager nodes even before patching is confirmed complete.
- Leader — Plan: Confirm whether Cisco Catalyst SD-WAN Manager is in your environment and escalate it to the high-priority patching queue; active exploitation is confirmed but scope appears targeted rather than the systemic, board-level event that would require immediate leadership briefing.
- Signals: CVE-2026-76504 — CISA KEV: not listed, EPSS n/a, no public PoC found, reported by 2 collected sources
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.