Cisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability

Cisco has issued emergency fixes for a critical flaw in Catalyst SD-WAN Manager that attackers are already exploiting. The bug, CVE-2026-76504, scores 9.8 on CVSS and stems from flawed URI encoding handling in HTTP requests, letting unauthenticated remote attackers slip past API session authentication and reach a restricted endpoint with admin-level privileges. Every Catalyst SD-WAN Manager deployment is vulnerable regardless of setup, and no workaround exists, so Cisco urges immediate upgrades to versions 26.2.1, 26.1.2.1, 20.18.4.1, 20.15.6.1, 20.12.8.2, or 20.9.10.1 — fixes already applied to Cisco-hosted SD-WAN instances. CISA has added the flaw to its Known Exploited Vulnerabilities catalog with a three-day remediation deadline for federal agencies, though neither Cisco nor CISA has disclosed specifics about the ongoing attacks.