Last Updated: 2026-10-03T00:38:56Z
What’s Happening
Cisco has released an advisory for CVE-2026-76504, a CVSSv3 9.8 Authentication Bypass in Cisco Catalyst SD-WAN Manager. All products running SD-WAN Manager are affected.
Cisco has reported that the vulnerability has been exploited in the wild.
VulnCheck has a detailed writeup of the vulnerability, including a proof-of-concept.
As of 2026-10-02T07:00:00Z, Cisco has released a Live Protect Shield for this vulnerability. Cisco Live Protect is a “hot patching” solution that allows the application of defensive fixes without rebooting.
Affected Versions
| Cisco Catalyst SD-WAN Software Release | First Fixed Release |
|---|---|
| Earlier than 20.9 | Migrate to a fixed release. |
| 20.9 | 20.9.10.1 |
| 20.12 | 20.12.8.2 |
| 20.15 | 20.15.6.1 |
| 20.18 | 20.18.4.1 |
| 26.1 | 26.1.2.1 |
| 26.2 | 26.2.1 |
Actions
Cisco has released patches for affected systems, so upgrade those ASAP. Also, let’s hear the old refrain one more time:
Stop putting management interfaces on the internet
Cisco has provided certain log patterns associated with exploitation. Administrators should review logs for these patterns.
There’s a Nuclei Template available to check vulnerability if you’re not sure.
Notes
Imagine some kind of incentive or penalty for getting management interfaces off the internet. I don’t know how; I don’t know who, but I’d love to see either a carrot or stick to motivate this.
