Cisco patches actively exploited SD-WAN zero-day

Cisco has issued security updates to address a critical zero-day vulnerability in its Catalyst SD-WAN Manager, which is being actively exploited in the wild. The flaw, identified as CVE-2026-76504, allows attackers to bypass authentication and escalate privileges to administrative levels within affected systems. The company confirmed that the vulnerability was discovered during investigations into ongoing attacks targeting enterprise networks using the SD-WAN solution.

What happened

The vulnerability affects Cisco Catalyst SD-WAN Manager, a centralized management platform for software-defined wide-area networking. Cisco released patches on Wednesday, 30 September 2026, after confirming that the flaw was being exploited in real-world attacks. The company did not disclose the number of affected customers or the geographic scope of the attacks but emphasized that the issue is critical and requires immediate attention from administrators.

Cisco’s security advisory states that the vulnerability can be exploited without user interaction, making it particularly dangerous for organizations relying on the platform for network management. The company has urged all customers to apply the updates as soon as possible to mitigate the risk of compromise.

What we don’t know yet

Details about the attackers, their motives, and the specific methods used to exploit the vulnerability remain unclear. Cisco has not released information on whether the attacks are targeted or opportunistic, nor has it provided indicators of compromise (IoCs) to help organizations detect potential breaches. The company also did not specify the timeline of the attacks or whether any data has been exfiltrated from compromised networks.