CISA adds actively exploited Cisco Catalyst SD-WAN Manager authentication bypass to KEV catalogue
An unauthenticated admin-level bypass on a system that controls network configuration centrally is about as severe as an enterprise vulnerability gets, and the federal deadline is tomorrow. Organisations running Catalyst SD-WAN should patch now, confirm their management interfaces are not reachable from the internet, and review admin activity for signs of earlier access. The repeated SD-WAN entries this year suggest the platform deserves a dedicated hardening review rather than ad hoc patching.
What Happened
CISA added CVE-2026-76504, a Cisco Catalyst SD-WAN Manager hex encoding vulnerability, to its Known Exploited Vulnerabilities catalogue based on evidence of active exploitation. The flaw carries a CVSS score of 9.8 and could allow an unauthenticated, remote attacker to access an affected system with admin privileges. Federal Civilian Executive Branch agencies must apply fixes by 3 October 2026; the KEV catalogue now lists eight Cisco SD-WAN flaws added in 2026.
Why It Matters
An unauthenticated admin-level bypass on a system that controls network configuration centrally is about as severe as an enterprise vulnerability gets, and the federal deadline is tomorrow. Organisations running Catalyst SD-WAN should patch now, confirm their management interfaces are not reachable from the internet, and review admin activity for signs of earlier access. The repeated SD-WAN entries this year suggest the platform deserves a dedicated hardening review rather than ad hoc patching.
Sources
- Cybersecurity and Infrastructure Security Agency (opens in a new tab): CISA Adds One Known Exploited Vulnerability to Catalog (2026-09-30)
- The Hacker News (opens in a new tab): CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV (2026-10-01)
- The Hacker News (opens in a new tab): Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager (2026-09-30)
More From This Briefing
- FTC opens investigation into OpenAI, Anthropic and other AI developers over product risks
- OpenAI cancels GPT-6.1 Astra release after model fails internal safety tests
- Frontier AI firms sign voluntary White House accord on safeguards
- Synopsys and Amazon sign multi-year $1bn-plus silicon IP agreement
This story is part of the Laurenceo Intelligence briefing for 2 October 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.