U.S. CISA adds Cisco Catalyst SD-WAN Manager flaw to its Known Exploited Vulnerabilities catalog

CISA added a critical Cisco Catalyst SD-WAN Manager authentication-bypass vulnerability (CVE-2026-76504, CVSS 9.8) to its Known Exploited Vulnerabilities catalog after Cisco confirmed active exploitation in September 2026; the flaw allows unauthenticated remote attackers to gain admin API access by bypassing authentication via crafted URL-encoded requests. Cisco published fixed releases and urgent mitigation guidance (no workaround for on‑premises), recommended log checks for j_security_check requests and viptela-reserved- prefixed usernames, and CISA ordered federal agencies to remediate by October 3, 2026.