CISA Warns of Exploited Cisco SD-WAN Manager Authentication Bypass

En bref

• CVE-2026-76504 carries a CVSS score of 9.8, rated critical.
• The vulnerability enables remote, unauthenticated authentication bypass.
• CISA added it to the Known Exploited Vulnerabilities catalog in October 2026.
• Attackers are actively exploiting the flaw to gain unauthorized access.

On a Wednesday in October 2026, CVE-2026-76504 was entered by the Cybersecurity and Infrastructure Security Agency into its Known Exploited Vulnerabilities catalog. The vulnerability resides in Cisco's Catalyst SD-WAN Manager, a central management platform for software-defined wide area networks. CISA's action followed reports of active exploitation in the wild.

The flaw is an authentication bypass that carries a CVSS score of 9.8, placing it in the critical range. A remote attacker with no credentials can exploit it to gain unauthorized access to affected systems. Because the attack requires no authentication, the barrier to entry is extremely low, and exploitation can be automated.

Organizations running the affected Cisco product are at risk. This includes any entity that relies on Catalyst SD-WAN Manager for network orchestration, from large enterprises to government agencies. Once an intruder bypasses authentication, they can move laterally, alter configurations, or disrupt operations.

CISA's addition to the KEV catalog signals that the threat is not theoretical. The agency has observed exploitation attempts and urges immediate remediation. While the KEV mandate applies to federal civilian agencies, private and public sector administrators should treat this as a top priority.

What to watch: proof-of-concept code may become public, increasing the likelihood of widespread scanning. Administrators should monitor for unusual login attempts, unexpected configuration changes, and signs of unauthorized access. Patching and mitigation should be applied without delay.

À faire maintenant

1. Immediately inventory all instances of Cisco Catalyst SD-WAN Manager in your environment.
2. Apply the vendor-supplied patch or mitigation as soon as it becomes available.
3. If patching is delayed, restrict management interface access to trusted IP addresses only.
4. Enable detailed logging and monitor for authentication bypass attempts or anomalous admin actions.
5. Review recent logs for signs of unauthorized access or unexpected configuration changes.
6. Isolate any systems suspected of compromise and preserve forensic evidence.
7. Report indicators of compromise to CISA or your local incident response team.

Références CVE

• CVE-2026-76504

Source originale

The Hacker News