CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV

CISA has placed a severe authentication-bypass vulnerability in Cisco Catalyst SD-WAN Manager on its Known Exploited Vulnerabilities list after confirming it is being actively abused in the wild. The flaw, CVE-2026-76504, carries a CVSS score of 9.8 and stems from faulty URI hex-encoding handling in HTTP requests, letting an unauthenticated remote attacker send a crafted request and reach the system's API with full admin rights. Cisco disclosed in September 2026 that it had detected exploitation but has not shared details on the attackers, the scale of compromise, or when the activity began, though it did publish log-based indicators of compromise tied to suspicious j_security_check entries. Federal civilian agencies must apply fixes by October 3, 2026, while watchTowr notes this marks the eighth Cisco SD-WAN CVE added to KEV in 2026 alone, underscoring why organizations should urgently patch and audit logs for exploitation attempts.