Cisco SD-WAN Manager zero-day CVE-2026-76504 exploited
Cisco has released security updates for a critical zero-day in Catalyst SD-WAN Manager that attackers are already using to gain administrator privileges on vulnerable systems. The flaw is tracked as CVE-2026-76504.
Catalyst SD-WAN Manager was previously called SD-WAN vManage. It is network management software that lets administrators monitor and control up to 6,000 SD-WAN devices from one dashboard. A compromise of this platform could therefore give an attacker a central view of, and potential control over, a large part of an organization's wide area network.
"In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability," the company said on Wednesday. PSIRT is Cisco's Product Security Incident Response Team, the group that handles vulnerability reports for the vendor's products. "Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability."