New Cisco SD-WAN zero-day exploited in-the-wild (CVE-2026-76504)

Cisco has confirmed that a new flaw in its SD-WAN platform, tracked as CVE-2026-76504, is being actively abused by attackers — the fifth such zero-day disclosed by the company this year. The company's security team spotted the active exploitation in September 2026 while investigating a customer support ticket, though it hasn't yet disclosed details about the attackers or their methods beyond sharing indicators of compromise.

The bug sits in Cisco Catalyst SD-WAN Manager, the console used to administer SD-WAN deployments, and stems from how the system processes URI encoding in HTTP requests. This flaw lets an attacker send a specially crafted request that slips past an authentication check meant to guard a particular API endpoint, effectively granting them admin-level API access and, potentially, control over the entire network. It affects Manager versions 26.2, 26.1, 20.18, 20.15, 20.12, 20.9 and all earlier releases, no matter how the system is configured.

Patches are available for the 20.9 through 26.2 branches, while customers on anything older than 20.9.10.1 need to upgrade since no workaround exists. Cisco recommends shielding on-premises installations from the public internet and, if remote access is unavoidable, limiting it to known trusted hosts. Organizations are also urged to check their serviceproxy-access.log and vmanage-server.log files for the published IoCs — and to save logs before patching in case forensic investigation is needed later. CISA has added the vulnerability to its Known Exploited Vulnerabilities list, giving US federal agencies until October 3, 2026, to patch and conduct a compromise assessment.