Cisco Advises Urgent Patching of Critical Authentication Bypass in SD-WAN Manager

On September 30, 2026, Cisco released an advisory warning of a critical vulnerability actively exploited in the wild. Tracked as CVE-2026-76504, the flaw affects Cisco Catalyst SD-WAN Manager. According to the advisory, a remote attacker without login credentials can bypass authentication and use the Manager's API as the admin user. This could lead to unauthenticated remote code execution or full administrative compromise of the SD-WAN management infrastructure. Cisco has released fixed releases to address the issue and notes that no workaround exists. The company has not disclosed the CVSS score or detailed exploit mechanics in the initial advisory, citing the need to avoid facilitating copycat activity. The vulnerability impacts organizations using Cisco Catalyst SD-WAN Manager to manage their SD-WAN networks. Cisco urges affected users to upgrade to the patched versions immediately.