Cisco’s admin door has a very bad lock

The unwelcome guest

Cisco says CVE-2026-76504 can give an unauthenticated remote attacker administrator-level API access to Catalyst SD-WAN Manager. Its severity score is 9.8, and Cisco says it became aware of active exploitation in September 2026. The advisory appeared September 30.^[1]

The calendar

CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 30 and lists October 3, 2026 as the remediation due date. That federal deadline is not a universal private-sector mandate. The entry also flags forensic triage as required.^[2]

The small print that matters

Cisco’s October 2 update adds a Live Protect shield but calls its protection temporary and partial. Upgrading to an appropriate fixed release remains the remedy. Cisco-managed cloud service is a separate case: the advisory says release 20.15.605 addresses the issue there without customer action.^[1]

Check the vendor’s release table and investigation guidance. Then retire the comforting little fiction that installing a patch proves nobody got in. The admin door needs fixing, droog; the visitor book still needs reading.