catalyst-sd-wan

Abstract cybersecurity illustration of a broken authentication lock with red data streams slipping past it into a ring of elevated admin privilege.

cisco

Unauthenticated admin access in Cisco Catalyst SD-WAN Manager is under active exploitation

A URI-encoding flaw (CVE-2026-76504, CVSS 9.8) lets an unauthenticated remote attacker reach the Catalyst SD-WAN Manager API with admin privileges. CISA added it to KEV on 2026-09-30; Cisco confirms active exploitation. Upgrade to a fixed release, or keep the system off the internet.