Critical Zero-Day in Cisco Catalyst SD-WAN Manager Actively Exploited

Cisco has confirmed the active exploitation of CVE-2026-76504, a zero-day vulnerability with a CVSS score of 9.8 affecting Catalyst SD-WAN Manager. The flaw in URI encoding handling allows an unauthenticated remote attacker to bypass an authentication rule and access APIs with administrative privileges. Cisco identified the malicious activity in September after analyzing a case opened with its support center and published indicators of compromise to assist defenders. CISA quickly added the flaw to its Known Exploited Vulnerabilities catalog, making remediation mandatory for U.S. federal agencies within the specified timeframe. The combination of remote access, lack of authentication, and administrative privileges makes it urgent to update systems, limit their exposure, and check for any signs of intrusion.

Source: The Hacker News