CISA has added a critical authentication bypass in Cisco Catalyst SD-WAN Manager to its Known Exploited Vulnerabilities catalog, confirming that attackers are already using it in the wild.
CVE-2026-76504 carries a CVSS score of 9.8. An unauthenticated remote attacker can exploit the flaw to access an affected system with the privileges of the admin user, no credentials and no prior access required. SD-WAN Manager is the single pane of glass that configures and controls an organization’s entire wide-area network overlay, which is exactly why an admin-level bypass here is so disproportionately damaging: it is not one router, it is the controller for all of them.
Organizations running Catalyst SD-WAN Manager should treat this the way CISA’s federal deadline implies: patch now, not on the next maintenance window. If the management interface is reachable from anywhere it does not strictly need to be, including over the open internet, that exposure needs closing regardless of patch status.
Centralized network controllers like SD-WAN Manager are a favorite target precisely because compromising one gives an attacker leverage over everything it manages. That is the exact failure mode our external network penetration testing is built to find before it becomes a live incident.