Critical Cisco Catalyst SD-WAN Zero-Day Under Active Exploitation

Cisco has issued an urgent security update to address a newly uncovered zero-day vulnerability in Cisco Catalyst SD-WAN Manager which has already been exploited in the wild.

In a security advisory published on September 30, Cisco issued a warning about CVE-2026-76504, a vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager which could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.

With a CVSS score of 9.8 the vulnerability is classed as critical. If it is not remediated immediately, it could result in widespread exploitation by malicious hackers, consequences of which could include data loss, system downtime or complete system takeover.

Any Cisco Catalyst SD-WAN Manager systems with ports exposed to the internet are potentially at risk of compromise.

CVE-2026-76504 Exploited in the Wild

According to Cisco, CVE-2026-76504 is already under “active exploitation” and…