Our takeCisco Catalyst SD-WAN Manager CVE-2026-76504 is a critical authentication bypass (CVSS 9.8) actively exploited in the wild. Patch now if you run it yourself.Security Resilience desk
Sources (7)
- nvd_recent · nvd_recent
- bleeping · bleeping
- rapid7 · rapid7
- hackernews · hackernews
- securityweek · securityweek
- cccs · cccs
- infosec_mag · infosec_mag
What this means for you — Security leader:Cisco has released patches for CVE-2026-76504, a critical (CVSS 9.8) authentication bypass in Catalyst SD-WAN Manager that is actively exploited in the wild and allows unauthenticated remote attackers to gain admin privileges. Apply the fixed releases immediately if you self-host the Manager; there is no workaround.
What this means for you — Lean IT orgs:If you use Cisco SD-WAN, check with your provider or MSP right away — Cisco released updates for a critical vulnerability that attackers are already using to take over the management system. Most small teams should ask your vendor or MSP to confirm the fix is applied.
What this means for you — MSP:CVE-2026-76504 is under active exploitation. Review all client Catalyst SD-WAN Manager instances (self-hosted) and deploy Cisco’s fixed releases; no workaround exists. Prioritize clients running affected versions.
What this means for you — Researcher:CVE-2026-76504 is a critical API authentication bypass (improper URI encoding) in Cisco Catalyst SD-WAN Manager, confirmed exploited in the wild per Cisco advisory and CISA-equivalent reporting. Fixed releases available, no workaround.