Cisco says attackers are actively exploiting a new zero-day in Catalyst SD-WAN Manager, the software used to centrally manage large SD-WAN networks. The flaw, CVE-2026-76504, is a critical authentication bypass caused by improper handling of URI encoding in HTTP requests, allowing an unauthenticated remote attacker to gain admin privileges via a crafted API request. Cisco released fixes for affected releases including 20.9, 20.12, 20.15, 20.18, 26.1, and 26.2, and published log-based indicators of compromise.
Why it matters: Organizations using Cisco Catalyst SD-WAN Manager should treat this as urgent because attackers can get administrator-level control without logging in. Update immediately to a fixed release and review the cited serviceproxy-access.log and vmanage-server.log entries for suspicious j_security_check requests from unknown IPs.
info@thehackernews.com (The Hacker News)
2026.09.30
98% relevant
The article appears to cover the same underlying event: Cisco warning that attackers are exploiting a critical authentication-bypass flaw in SD-WAN Manager. It reinforces the exploitation status and urgency around the Cisco SD-WAN Manager zero-day tied to administrator access.
Sergiu Gatlan
2026.09.30
100% relevant
This article establishes a distinct new Cisco SD-WAN zero-day event centered on CVE-2026-76504, separate from previously tracked Cisco SD-WAN flaws such as CVE-2026-20245, CVE-2026-20262, and CVE-2026-20127.
← Back to all stories