Grade One Press

Technology reporting you can check

News · Security & privacy

An exploited Cisco flaw lets attackers into SD-WAN Manager as admin; US agencies get three days to act

Cisco says an unauthenticated attacker can reach the network-management system's API with admin rights, and there is no workaround. It is the ninth Cisco SD-WAN flaw CISA has listed as exploited this year.

Grade One Newsroom · 1 min read

Sources: 3 · top grade 1How evidence is graded

An exploited Cisco SD-WAN Manager flaw gives attackers admin access, with no workaround

Grade 3 · Filed record

Source: Cisco Systems

What changed
Cisco fixed CVE-2026-76504 in Catalyst SD-WAN Manager on 30 September and said it is being exploited. CISA listed it the same day, with a 3 October deadline for US agencies.
Who it affects
Organisations running Cisco Catalyst SD-WAN Manager on their own systems, in any configuration. Cisco says its cloud-hosted service is already fixed.
What it does not tell you
How many systems are exposed or have been broken into, or who is behind the attacks. Neither Cisco nor CISA says.

The full story Check the source

Cisco said on 30 September that attackers are exploiting a flaw in Catalyst SD-WAN Manager, the system companies use to run their wide-area networks. The flaw lets an unauthenticated attacker reach its API with the privileges of the admin user [1].

The US Cybersecurity and Infrastructure Security Agency added the flaw, CVE-2026-76504, to its catalogue of exploited vulnerabilities the same day. It gave federal agencies until 3 October to act [2].

Cisco rates the flaw 9.8 out of 10. It is the only score in the US vulnerability database's record so far [3].

Cisco says it learned of the attacks in September, and found the flaw while resolving a customer's support case. There is no workaround, only fixed software [1].

It is the ninth flaw in Cisco's SD-WAN products that CISA has listed as exploited in 2026, after entries in February, April, May and June [2].

What it covers

Catalyst SD-WAN Manager in any configuration, in releases before 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1. Releases older than 20.9 have to move to a fixed one [1].

Cisco says its cloud-hosted SD-WAN service has been fixed and its customers need do nothing. For systems run on customers' own premises, it advises keeping the manager off the open internet until it is upgraded [1].

Cisco's advisory lists log entries to look for as signs of compromise [1]. CISA tells agencies to apply the fixes, follow its forensic triage requirements, and stop using the product where fixes cannot be applied [2].

What it does not tell you

How many systems are exposed or have been compromised, or who is behind the attacks. Neither Cisco nor CISA says [1][2].

Sources and their grades

  1. Cisco Systems, Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability (cisco-sa-sdwan-webauth-xr8beuuU). Read 1 October 2026. Grade 3 · Filed record First published 30 September 2026, 13:00 GMT. The maker's own account of its product: affected and fixed releases, and how it learned of the attacks.
  2. US Cybersecurity and Infrastructure Security Agency (CISA), Known Exploited Vulnerabilities Catalog, entry CVE-2026-76504. Read 1 October 2026. Grade 1 · Primary Added 30 September 2026, due 3 October. A listing means CISA has evidence of exploitation. Also used for the count of Cisco SD-WAN entries added in 2026.
  3. US National Vulnerability Database (NIST), CVE-2026-76504. Read 1 October 2026. Grade 1 · Primary Published 30 September 2026. The only severity score in the record is Cisco's own; NIST has not added one.

A grade says how much weight a source will take, from 1 (a body that can compel an answer and has nothing to sell) to 5 (somebody describing what they sell, or themselves). The standard sets out what each grade may be used for.

Filed under Network security Vulnerabilities

Comments

Commenting needs an account, made with nothing but an email address. A first comment is read before it appears.

More news

See all