Cisco has warned of CVE-2026-76504, a critical Catalyst SD-WAN Manager vulnerability reported with a CVSS score of 9.8. The issue may allow an unauthenticated remote attacker to send crafted requests and obtain administrator access, and reporting says Cisco has observed active exploitation.
For network defenders, the combination of unauthenticated access, administrative impact, and active exploitation warrants immediate exposure review. Inventory Catalyst SD-WAN Manager deployments, identify internet-reachable management surfaces, and tightly limit access paths while vendor remediation information is assessed.
Where a permanent software fix is unavailable, compensating controls need to be operational rather than merely documented: restrict management access to trusted networks, enforce strong administrative monitoring, and review logs for unexpected configuration changes or new privileged sessions. Incident responders should preserve relevant telemetry before making disruptive changes.
Security teams should also check vendor advisories directly for updated availability and mitigation guidance. Active-exploitation claims change quickly, so this item should remain in the patch and threat-monitoring queue until the affected estate is accounted for.
Source: Check Point Research, October 5 threat intelligence report; Infosecurity Magazine.