CVE-2026-76504: Cisco Catalyst SD-WAN Manager auth bypass

Cisco disclosed CVE-2026-76504 (CVSS 9.8) in Catalyst SD-WAN Manager: an unauthenticated attacker gains admin API access with a single HTTP request using percent-encoding. The flaw was actively exploited in September 2026, and CISA added it to its KEV catalog with an October 3 federal patch deadline.

• CVSS 9.8: unauthenticated auth bypass via a single HTTP request
• Exploited in the wild in September 2026; CISA KEV added September 30
• Fixed in 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, 26.2.1
• One Manager oversees up to 6,000 devices, exposing the whole WAN