Cisco warns of new SD-WAN zero-day exploited in attacks

Cisco has released security updates addressing a critical zero-day vulnerability tracked as CVE-2026-76504 in the Catalyst SD-WAN Manager product. The flaw is being actively exploited by attackers in the wild. Successful exploitation allows threat actors to escalate privileges to administrator level. Cisco confirmed the vulnerability is an authentication bypass issue. The company urges administrators to apply the released security patches immediately. The active exploitation status makes this a high-priority remediation item for affected organizations. Catalyst SD-WAN Manager is widely deployed in enterprise network environments, increasing the potential impact. No additional threat actor attribution details were provided in the article.