Cisco discloses actively exploited CVSS 9.8 authentication bypass in Catalyst SD-WAN Manager

Cisco disclosed CVE-2026-76504, a critical authentication bypass in Catalyst SD-WAN Manager that lets an unauthenticated remote attacker reach the API with admin privileges. Cisco said it became aware of active exploitation in September, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 30. Cisco says all deployments are affected regardless of configuration and no workarounds exist, so fixed software releases are the only remedy.

• CVE-2026-76504, CVSS 9.8, Catalyst SD-WAN Manager
• Actively exploited; CISA added it to the KEV catalog on September 30
• No workarounds; fixed builds exist for several release trains
• Investigators are told to review SD-WAN Manager access logs for compromise