Act
archived
CISA KEV: Cisco Catalyst SD-WAN Manager Auth Bypass Actively Exploited
- Engineer — Act: Patch Cisco Catalyst SD-WAN Manager immediately — CVE-2026-76504 is KEV-listed, has a public PoC, and is under active exploitation; unauthenticated remote access at CVSS 9.8 makes this an emergency change window, not a scheduled patch.
- SOC/IR — Act: Assume-breach posture for any environment running Cisco Catalyst SD-WAN Manager: sweep authentication logs for anomalous access since before the KEV listing date and hunt for unauthorized management-plane sessions; apply Cisco’s published IOCs if available.
- Leader — Act: Confirm this week whether your org runs Cisco Catalyst SD-WAN Manager, then direct engineering to treat patching as emergency; active exploitation plus KEV listing makes this a likely customer or board question for network-heavy sectors.
- Signals: CVE-2026-76504 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.