Cybersecurity
CISA adds Cisco SD-WAN flaw to KEV
CISA added a Cisco Catalyst SD-WAN Manager authentication bypass to its exploited-vulnerabilities list after Cisco said it had seen active attacks, and federal civilian agencies were told to patch by 3 October 2026.
- CISA added CVE-2026-76504 affecting Cisco Catalyst SD-WAN Manager to its Known Exploited Vulnerabilities catalogue on Wednesday.
- Cisco said it became aware of active exploitation of the flaw in September 2026 and published indicators of compromise for customers.
- CISA said the flaw could let an unauthenticated remote attacker reach the affected system with admin privileges.
- Federal Civilian Executive Branch agencies had until 3 October 2026 to apply the fixes.
CISA added CVE-2026-76504 to its Known Exploited Vulnerabilities list after reports of active exploitation. The flaw in Cisco Catalyst SD-WAN Manager was rated 9.8 and involved faulty handling of URI encoding in an HTTP request.
CISA said a successful attack could let a remote, unauthenticated user bypass authentication and access the API as the admin user. Cisco said it had seen exploitation in September 2026 and released indicators of compromise for customers to use in their checks.
Cisco told customers to review /var/log/nms/containers/service-proxy/serviceproxy-access.log for j_security_check entries from unknown or unauthorised IP addresses. It also pointed them to /var/log/nms/vmanage-server.log for the same pattern, especially where user names began with viptela-reserved-.
Cisco did not give details on the activity, the attacker, the number of affected organisations, or when the first exploitation took place. CISA said Federal Civilian Executive Branch agencies had until 3 October 2026 to install the fixes.
Jake Knott, head of threat intelligence at watchTowr, said in a statement that repeated KEV entries showed attackers had recognised the value of the platform. He said he did not expect the pattern to slow down.
Named in this story
People
- Jake Knott
- said repeated KEV listings showed attackers valued the platform
Companies
- Cisco
- said it had seen active exploitation and issued checking guidance
- watchTowr
- employed the threat-intelligence head quoted in the story
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency (CISA)
- added the flaw to its exploited-vulnerabilities catalogue
- Federal Civilian Executive Branch (FCEB) agencies
- had until 3 October 2026 to apply the fixes
Products and systems
- Cisco Catalyst SD-WAN Manager
- the affected management platform
- CVE-2026-76504
- the authentication bypass flaw tracked by CISA
How the source tells it
The piece was mostly a technical advisory, but it included a brief alarmed framing from a threat-intelligence quote.
- Urgency the patch deadline and advice to act as soon as possible
- Alarm a quoted comment framed repeated listings as a signal that attackers valued the platform