Disclosure summary
Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.
CISA remediation guidance
Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlined in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
Rapid7 Blog · RSS-e6b4659f60517e3904adf3788f5d5c65771
Open original source · Updated Sep 30, 2026
Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)
CVE mention in publisher metadata; check the original affected versions.
Threat Intelligence · RSS-d2fd2edad7ca639dbc00ecd39751c04a5b4
Open original source · Updated Jun 24, 2026
Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager
CVE mention in publisher metadata; check the original affected versions.
Original records & references
PUBLISHED 2026-05-14T00:00:00-04:00
MODIFIED 2026-05-14T00:00:00-04:00
INGESTED 2026-10-06T11:42:57-04:00