CVE-2026-76504

Cisco Confirms Active Exploitation of CVE-2026-76504 in Catalyst SD-WAN Manager

Cisco has confirmed that the critical vulnerability CVE-2026-76504 in Catalyst SD-WAN Manager has been exploited in attacks throughout September. The flaw carries a CVSS score of 9.8 and allows attackers to gain full administrator access without any credentials by bypassing API authentication through malformed URI encoding. The issue affects the login session handling mechanism, enabling forged requests to grant netadmin privileges by default. Similar URI manipulation techniques were observed earlier this month in Oracle PeopleSoft attacks. Patches are available across multiple release trains including 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1, while older installations must migrate to supported versions. Cisco recommends restricting access to trusted hosts and placing the Manager behind firewalls until updates are applied. The vulnerability was discovered during routine support operations and verified by Cisco's Product Security Incident Response Team.

US Authorities Warn of Active Exploitation of Apple CoreGraphics and Cisco SD-WAN Vulnerabilities

The US Cybersecurity and Infrastructure Security Agency (CISA) has added two newly identified vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-86950 affects Apple iOS, iPadOS, and macOS through a flaw in the CoreGraphics framework that allows out-of-bounds memory writes and potential arbitrary code execution. CVE-2026-76504 impacts Cisco Catalyst SD-WAN Manager, enabling unauthenticated attackers to gain administrative access due to improper URI encoding handling in the API. Federal agencies must remediate both issues within three days of their respective catalog additions. CISA also requires organizations to check for signs of compromise in addition to applying patches. The alerts highlight ongoing risks to widely deployed Apple operating systems and enterprise SD-WAN infrastructure.

Cisco Patches Critical Zero-Day Authentication Bypass in Catalyst SD-WAN Manager

Cisco Systems has released security updates to address a critical zero-day vulnerability in Cisco Catalyst SD-WAN Manager that allows attackers to bypass authentication and gain remote administrator access. The flaw, tracked as CVE-2026-76504, stems from improper URI encoding handling in HTTP requests targeting specific APIs. With a CVSS v3.1 base score of 9.8, the issue is rated Critical and has already been exploited in real-world attacks confirmed by Cisco in September 2026. The company published its security advisory on September 30, 2026, and strongly recommends immediate updates to the fixed releases. Organizations are also advised to restrict API access to trusted sources while applying the patches.