Fifth Cisco SD-WAN Vulnerability Actively Exploited by Attackers This Year

Cisco has disclosed that attackers are actively exploiting a previously unknown authentication bypass vulnerability in its Catalyst SD-WAN Manager platform. The flaw stems from improper URI encoding handling that allows attackers to bypass authentication and gain admin-level API access, potentially giving them control over entire networks. The vendor has released security patches for affected versions and provided indicators of compromise to help defenders identify any breach attempts.

This marks the fifth zero-day vulnerability discovered in Cisco's SD-WAN infrastructure during 2026, suggesting a pattern of security challenges in this critical networking technology. The flaw exploits a fundamental weakness in how the system processes web requests, permitting threat actors to circumvent standard authentication mechanisms and obtain unrestricted administrative capabilities. The vulnerability's presence across multiple software versions released over several years indicates a potentially long exposure window for organizations using older deployments.

Cisco's remediation strategy includes both software patches for supported versions and network-level containment measures for customers unable to update immediately. The company has provided forensic indicators that system administrators can review within their logs, though distinguishing legitimate activity from malicious probes may require expert analysis. Federal agencies face a compressed timeline for assessment and remediation under the CISA directive.