CVE-2026-76504: Critical Cisco SD-WAN Manager Zero-Day Exploited in the Wild
ID: 385a74ed-3e26-5d34-81aa-b3d9603385d9
STIX ID: report--385a74ed-3e26-5d34-81aa-b3d9603385d9
Feed Name: SOC Prime Blog
Threat Score
**Executive summary:** Cisco disclosed CVE-2026-76504, a critical (CVSS 9.8) authentication-bypass in Catalyst SD-WAN Manager that permits unauthenticated administrative API access; Cisco confirmed active exploitation in September 2026 and CISA added it to the KEV catalog. Patches and fixed releases are available and organizations are urged to upgrade immediately and apply exposure-reduction measures; relevant IOCs include URI-encoded j_security_check requests such as /%6a_security_check.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.