Cybersecurity
Cisco patches SD-WAN zero-day under attack
Cisco said it had released updates for a Catalyst SD-WAN Manager flaw after active exploitation, and CISA added the issue to its exploited list with a federal deadline.
- Cisco said it had released security updates for CVE-2026-76504 in Catalyst SD-WAN Manager after learning in September 2026 that it was being actively exploited.
- The company said the flaw affected all deployments and could let an unauthenticated remote attacker reach the system with admin privileges.
- Cisco said the issue came from improper handling of URI encoding in an HTTP request, which let a request bypass an authentication rule for a specific API endpoint.
- Cisco said attackers were using %6a in malicious requests and told administrators to review two log files and unknown or unauthorised IP addresses.
- CISA added CVE-2026-76504 to its Known Exploited Vulnerabilities Catalog and told U.S. federal agencies to secure systems by Saturday, October 3.
Cisco said it had released updates for a flaw in Catalyst SD-WAN Manager, which it had previously called SD-WAN vManage, after the Cisco PSIRT became aware in September 2026 that it was being actively exploited. It urged customers to move to a fixed software release.
The company said the bug affected all deployments and sat in API session-based authentication management. It said the issue allowed remote unauthenticated access with admin privileges.
Cisco said the flaw resulted from improper handling of URI encoding in an HTTP request. That let an attacker bypass a rule meant to limit access to a particular API endpoint.
Cisco said threat actors were using %6a, the encoded form of j, in malicious requests. It advised checking serviceproxy-access.log and vmanage-server.log for j_security_check entries from unknown or unauthorised IP addresses, and said customers could open a case with Cisco TAC after collecting administrative technical files.
CISA added CVE-2026-76504 to the Known Exploited Vulnerabilities Catalog and told U.S. federal agencies to secure their systems by Saturday, October 3. The article said it was the fifth SD-WAN zero-day actively exploited in 2026, and that CISA has tagged 90 Cisco vulnerabilities as exploited since November 2021.
Named in this story
Companies
- Cisco
- released the security updates and warned customers
Organisations
- Cisco PSIRT
- became aware of active exploitation in September 2026
- Cisco TAC
- could help customers determine whether systems had been compromised
Governments and agencies
- Cybersecurity and Infrastructure Security Agency
- added the CVE to its exploited-vulnerabilities list and set a deadline
- U.S. federal agencies
- were ordered to secure their systems by Saturday, October 3
Products and systems
- Cisco Catalyst SD-WAN Manager
- was the affected network management software
How the source tells it
The register was a straightforward security advisory with an urgent warning frame built from active-exploitation notices and remediation deadlines.
- urgency repeated calls to upgrade and the federal deadline for remediation
- threat active-exploitation language and the route to unauthorised admin access