[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_rTyPxB4fi1A1eU725r19Kg8-8EG8uou8P3rYlH-t3M":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":44,"controls":45},"0fbcde78-47c3-4357-b638-4af3c899e705","cisco-sd-wan-vulnerability-actively-exploited-cisa-adds-to-kev-catalog","93216259-4855-4d12-8e30-9488c50dacf4","Cisco SD-WAN Vulnerability Actively Exploited — CISA Adds to KEV Catalog","A hex encoding vulnerability (CVE-2026-76504) in Cisco Catalyst SD-WAN Manager has been added to CISA's Known Exploited Vulnerabilities Catalog following evidence of active exploitation in the wild. This means threat actors are already leveraging this flaw, making unpatched systems an immediate and tangible risk rather than a theoretical one. Federal agencies are now mandated to remediate this vulnerability under Binding Operational Directive BOD 26-04, underscoring the critical importance of timely, risk-based patch management. Organizations that lack structured vulnerability prioritization programs are disproportionately exposed when widely-used network management platforms like SD-WAN controllers become active attack targets.","**Immediate Actions:**\n- Apply the latest Cisco-issued patch or upgrade for Catalyst SD-WAN Manager without delay, prioritizing any internet-facing instances.\n- Run authenticated vulnerability scans across all SD-WAN infrastructure to identify exposed or unpatched nodes.\n- Restrict management-plane access to SD-WAN Manager using allowlists and firewall rules to reduce the attack surface while patching is underway.\n\n**Long-Term Improvements:**\n- Establish a formal vulnerability prioritization process that cross-references CVEs against the CISA KEV Catalog automatically.\n- Maintain a continuously updated inventory of all network appliances, software versions, and exposure status to accelerate future patch cycles.\n- Implement network segmentation to isolate SD-WAN management systems from general corporate traffic and the public internet.\n\n**Detection Measures:**\n- Enable centralized logging and SIEM alerting for anomalous authentication attempts or configuration changes on SD-WAN Manager.\n- Subscribe to CISA KEV Catalog feeds and vendor security advisories to receive real-time notification of newly exploited vulnerabilities.\n- Conduct regular threat-hunting exercises focused on network management platforms to detect post-exploitation indicators early.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST RA-5: Vulnerability Monitoring and Scanning","NIST SC-7: Boundary Protection (Network Segmentation)","CISA Binding Operational Directive BOD 22-01: Known Exploited Vulnerabilities","CISA Binding Operational Directive BOD 26-04: Risk-Based Vulnerability Management","ITIL 4: Change Enablement \u002F Vulnerability Management Practice","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of Technical Vulnerabilities",{},"published","2026-09-30T20:21:16.600258+00:00","2026-09-30T20:21:16.487+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Falerts\u002F2026\u002F09\u002F30\u002Fcisa-adds-one-known-exploited-vulnerability-catalog","cisa-adds-one-known-exploited-vulnerability-to-catalog-13e00a","CISA Adds One Known Exploited Vulnerability to Catalog",[32,38],{"id":33,"name":34,"slug":35,"description":36,"color":37},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":39,"name":40,"slug":41,"description":42,"color":43},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[46,49,52],{"slug":35,"name":47,"problem":48},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":41,"name":50,"problem":51},"Automated patch management","Known holes get closed in days, not months.",{"slug":53,"name":54,"problem":55},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have."]