[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1hfdtX2z18ezxDoX2hHWGg1QnZhKytiLCOc09-fzcpU":3},{"article":4,"iocs":47,"watch_terms":52,"solutions":53,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"dd9bd6be-dfd1-4ca2-bc3b-88088d839d47","CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV","cisa-adds-exploited-cisco-catalyst-sd-wan-manager-auth-bypass-to-kev-346b23","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical authentication bypass flaw impacting Cisco Catalyst SD-WAN Manager to its Known Exploited Vulnerabilities (KEV), following reports of active exploitation. The vulnerability, tracked as CVE-2026-76504 (CVSS score: 9.8), could allow an unauthenticated, remote attacker to access an affected system with","CISA has added CVE-2026-76504, a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager (CVSS 9.8), to its Known Exploited Vulnerabilities catalog following confirmed active exploitation. The flaw allows unauthenticated remote attackers to gain admin-level access by crafting malicious HTTP requests that exploit improper URI encoding handling. Federal civilian agencies must patch by October 3, 2026, and Cisco has provided IoC hunting guidance including suspicious j_security_check API calls.","CISA adds critical Cisco Catalyst SD-WAN Manager auth bypass (CVE-2026-76504) to KEV list due to active exploitation.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fcisa-adds-exploited-cisco-catalyst-sd.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEj8jgm3LMY2zr1S1DmXnvVEPDiTKYR5FXHW7q_6duG1lVPhzbW2ZfJwRM9glqAJrQhBX3HAAiksz-tUpRN4pfT9VWHUksa-1SgHZmKcNUd1tJfsyFiwhtezZN_zBM_cEmqjkECI_2gfWhnqZ1ry2hgDou-qQCB21zbl1RzYN9JB0bRjqzhB2m6gBomg-ow9\u002Fs1600\u002Fcisa-wan.jpg","2026-10-01T10:33:16+00:00","2026-10-01T12:00:16.766999+00:00",9,[17,20,23],{"name":18,"type":19},"Cisco","vendor",{"name":21,"type":22},"Cisco Catalyst SD-WAN Manager","product",{"name":24,"type":25},"SD-WAN","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,37,42],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":44,"icon":28,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48],{"type":49,"value":50,"context":51},"cve","CVE-2026-76504","Critical authentication bypass in Cisco Catalyst SD-WAN Manager allowing unauthenticated remote admin access",[18,21],{"controls":54,"vendors":142},[55,84,113],{"slug":56,"name":57,"problem":58,"products":59},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":85,"name":86,"problem":87,"products":88},"patch-management","Automated patch management","Known holes get closed in days, not months.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":114,"name":115,"problem":116,"products":117},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"axoflow","Axoflow","\u002Fvendor-logos\u002Faxoflow.png","axolake","AxoLake","https:\u002F\u002Faxoflow.com\u002Faxolake-petabyte-security-data-storage","Data lake for security data in Parquet format, searchable in place without rehydration.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"cribl","Cribl","\u002Fvendor-logos\u002Fcribl.png","cribl-stream","Cribl Stream","https:\u002F\u002Fcribl.io\u002Fproducts\u002Fstream\u002F","Collects, reduces, redacts and routes data between sources and tools, keeps a full-fidelity copy in low-cost storage, and replays it when needed.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"abstract-security","Abstract Security","\u002Fvendor-logos\u002Fabstract-security.png","abstract-pipelines","Abstract Pipelines","https:\u002F\u002Fwww.abstract.security\u002Fplatform\u002Fcollection","Collects security data from any source, normalises it in the pipeline and routes it to several destinations.",[143],{"slug":144,"name":18,"logo_path":145,"roles":146},"cisco","\u002Fvendor-logos\u002Fcisco.png",[147],"affected",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":164},"critical-cisco-sd-wan-auth-bypass-exploited-in-the-wild-1790857283100","Critical Cisco SD-WAN Auth Bypass Exploited in the Wild","CVE-2026-76504 exposes a fundamental flaw in how Cisco Catalyst SD-WAN Manager handles URI encoding, allowing unauthenticated attackers to craft malicious HTTP requests that completely bypass authentication and gain administrative access. This is particularly dangerous because SD-WAN Manager sits at the heart of enterprise network infrastructure — admin-level compromise means an attacker can manipulate routing, intercept traffic, or pivot laterally across the entire WAN fabric. The CVSS score of 9.8 reflects how low the barrier to exploitation is: no credentials, no special position on the network, just a crafted HTTP request. CISA's addition to the KEV catalog confirms this is not theoretical — real attackers are actively weaponizing this flaw, making delayed patching an immediate operational risk.",[153,154,155,156,157,158,159,160,161,162,163],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 AU-6: Audit Record Review and Analysis","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","NIST CSF RS.MI-3: Newly Identified Vulnerabilities Mitigated","CISA BOD 22-01: Known Exploited Vulnerabilities Catalog","ITIL 4: Change Enablement (Emergency Change Procedure)","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities",{}]