October 8, 2026 · 1 min read
CVE-2026-76504: Cisco Catalyst SD-WAN Manager exploitation alert
CISA added CVE-2026-76504 to its Known Exploited Vulnerabilities catalog on 2026-09-30. Review affected Cisco Catalyst SD-WAN Manager deployments and vendor mitigation guidance.
CVE-2026-76504: what changed
CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 2026-09-30. Inclusion indicates evidence of exploitation; it does not establish that your own systems have been compromised.
Affected product
Cisco Catalyst SD-WAN Manager. Confirm affected versions against the vendor advisory.
CISA description
Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.
Recommended response
Inventory affected deployments, check vendor guidance for fixes or mitigations, and verify the update was applied. Review available logs and incident-response guidance when exploitation is suspected.
Catalog context
CISA lists a remediation due date of 2026-10-03. Federal directive deadlines have a defined scope; other organizations should prioritize according to their exposure and risk. Ransomware campaign use is listed as unknown; “unknown” does not mean exploitation is absent.
Sources
Automated security brief based on CISA catalog data. Catalog addition date: 2026-09-30.