Cisco Systems Inc. issued a critical security advisory on September 30, 2026, warning that attackers are actively exploiting a zero-day authentication bypass in its Catalyst SD-WAN Manager. The flaw, identified as CVE-2026-76504, has a critical CVSS score of 9.8 out of 10.
A remote, unauthenticated attacker could send a specially crafted API request to gain administrative access to the management interface. Cisco’s Product Security Incident Response Team (PSIRT) became aware of the exploitation in September 2026.
Cisco has released software updates to address the flaw and strongly recommends that customers upgrade their systems. No workarounds are available.