CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV
Summary: CISA added CVE-2026-76504, a critical authentication bypass in Cisco Catalyst SD-WAN Manager with a CVSS score of 9.8, to its Known Exploited Vulnerabilities catalog on Wednesday after reports of active exploitation. The flaw stems from improper handling of URI encoding in HTTP requests, letting an unauthenticated remote attacker send a crafted request to the API and gain admin-level access; Cisco said it learned of exploitation in September 2026 and published indicators of compromise, while FCEB agencies have until October 3, 2026, to apply fixes.
What you should know: Eight Cisco SD-WAN CVEs have landed on KEV in 2026 alone, and this one hands an unauthenticated attacker admin rights over the single pane of glass used to manage, configure, and monitor large networks.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-76504
- Related
- CVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability Known Exploited Vulnerabilities · Sep 30, 2026