CISA Sets October 3 Deadline for Critical Cisco SD-WAN Vulnerability (CVE-2026-76504) Exploited In The Wild

The Cybersecurity and Infrastructure Security Agency (CISA) has set an October 3, 2026, federal remediation deadline for a critical authentication bypass vulnerability (CVE-2026-76504) in Cisco Catalyst SD-WAN Manager. Rated 9.8 on the CVSS scale, the flaw, which stems from improper handling of URI encoding in HTTP requests, is actively being exploited in the wild, allowing unauthenticated attackers to gain administrative privileges. Cisco has confirmed no workaround exists, urging affected organizations to upgrade to fixed releases.

Context

CVE-2026-76504 is an authentication bypass vulnerability that affects Cisco Catalyst SD-WAN Manager. It arises from improper URI encoding in HTTP requests, which has led to active exploitation by attackers. Cisco has indicated that there is no workaround available, making timely upgrades essential for affected users.

Why it matters

The vulnerability in Cisco's SD-WAN Manager poses a serious security risk, allowing unauthorized access to critical systems. With a CVSS score of 9.8, it is classified as highly severe. The federal deadline for remediation emphasizes the urgency for organizations to address this flaw to protect their networks.

Implications

If organizations fail to address this vulnerability, they risk significant security breaches, potentially leading to data loss and operational disruptions. The threat extends to all entities using the affected Cisco systems, including government agencies and private sector companies. Compliance with CISA's deadline will be crucial to mitigate risks.

What to watch

Organizations using Cisco Catalyst SD-WAN Manager should prioritize upgrading their systems before the October 3, 2026, deadline. Monitoring for any indications of exploitation attempts will be critical in the lead-up to this date. CISA may release additional guidance or updates as the deadline approaches.