CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV
CISA adds critical Cisco Catalyst SD-WAN Manager auth bypass (CVE-2026-76504) to KEV list due to active exploitation.
CISA has added CVE-2026-76504, a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager (CVSS 9.8), to its Known Exploited Vulnerabilities catalog following confirmed active exploitation. The flaw allows unauthenticated remote attackers to gain admin-level access by crafting malicious HTTP requests that exploit improper URI encoding handling. Federal civilian agencies must patch by October 3, 2026, and Cisco has provided IoC hunting guidance including suspicious j_security_check API calls.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Cisco?
Get an email when a new story names Cisco, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCVE-2026-76504 exposes a fundamental flaw in how Cisco Catalyst SD-WAN Manager handles URI encoding, allowing unauthenticated attackers to craft malicious HTTP requests that completely bypass authentication and gain administrative access. This is particularly dangerous because SD-WAN Manager sits at the heart of enterprise network infrastructure — admin-level compromise means an attacker can manipulate routing, intercept traffic, or pivot laterally across the entire WAN fabric. The CVSS score of 9.8 reflects how low the barrier to exploitation is: no credentials, no special position on the network, just a crafted HTTP request. CISA's addition to the KEV catalog confirms this is not theoretical — real attackers are actively weaponizing this flaw, making delayed patching an immediate operational risk.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Automated patch management
Known holes get closed in days, not months.
- Log management and security data pipelines
Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-76504