Critical Cisco Network Appliance Flaw Now Listed as Actively Exploited Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency added a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager to its list of known exploited vulnerabilities following confirmation of active attacks. The flaw, identified as CVE-2026-76504 with a severity score of 9.8, allows unauthenticated remote attackers to gain unauthorized system access. Organizations running affected versions face immediate risk and should prioritize patching.

The vulnerability affects Cisco's SD-WAN Manager, a network appliance used by organizations to manage software-defined wide-area network infrastructure. By exploiting this flaw, attackers can bypass authentication mechanisms entirely, potentially gaining full system access without legitimate credentials. The assignment to CISA's actively exploited vulnerabilities list signals that threat actors have already demonstrated working attacks in the wild, moving this from theoretical risk to confirmed danger.

The high severity rating of 9.8 reflects the combination of authentication bypass capability and remote accessibility—attackers need neither physical access nor valid user credentials to attempt exploitation. Organizations using vulnerable versions face a compressed timeline for response, as the public disclosure of active exploitation typically accelerates attack campaigns.