Emerging ThreatsMalware & Ransomware

Cisco Discloses SD-WAN Zero-Day Exploited in Attacks

Analyst 207||Source: BleepingComputer
Network operations room with router, cables, and equipment under fluorescent lighting.

"In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability," Cisco warned — a brief, stark sentence that crystallizes the urgency for organizations running Catalyst SD‑WAN Manager.

Cisco PSIRT alert on CVE-2026-76504

Cisco released security updates to address a critical zero‑day in Catalyst SD‑WAN Manager tracked as CVE-2026-76504 and said attackers are actively exploiting the flaw to escalate to administrative privileges. The company "strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability," Cisco wrote on Wednesday. Catalyst SD‑WAN Manager, formerly known as SD‑WAN vManage, is network management software that permits administrators to monitor and manage up to 6,000 SD‑WAN devices from a single dashboard.

How CVE-2026-76504 bypasses SD‑WAN API authentication

The vulnerability affects all deployments "regardless of system configuration." Cisco identified the weakness in API session‑based authentication management and said it allows unauthenticated attackers to access vulnerable systems remotely with admin privileges. According to Cisco, "this vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint." An attacker can exploit the issue by "sending a crafted HTTP request to the API of the affected system."

Indicators, logs, and immediate forensic steps

  • Cisco provided specific indicators of compromise (IOCs): threat actors are using %6a as the URI‑encoded character "j" in malicious requests.
  • Administrators investigating possible compromise should check the serviceproxy-access.log file at /var/log/nms/containers/service-proxy and the vmanage-server.log file at /var/log/nms/ for entries related to j_security_check originating from unknown or unauthorized IP addresses.
  • For help determining whether a Cisco Catalyst SD‑WAN Manager has been compromised, Cisco advised that "customers may open a case with the Cisco TAC" and that admins should first collect admin-tech files to support a review.

Why Catalyst SD‑WAN Manager customers are exposed

Two facts in Cisco's advisory increase the operational risk: the product is designed to centrally control thousands of edge devices, and the vulnerability gives remote, unauthenticated attackers admin privileges on any affected deployment. Cisco also noted it would not limit applicability by environment: the flaw "affects all deployments regardless of system configuration." While Cisco did not disclose further technical details about active attacks, it did publish the encoded‑character IOC and the log locations administrators should inspect.

How technologists, affected enterprises, and adversaries are likely to respond

  • Technologists and security teams: will prioritize upgrading to Cisco's fixed software release and searching the specified logs (serviceproxy-access.log and vmanage-server.log) for j_security_check entries and %6a‑encoded requests; they may open a Cisco TAC case and collect admin‑tech files to support incident validation.
  • Affected enterprises and procurement leaders: must assess exposure across any Catalyst SD‑WAN Manager instances (each of which may manage up to 6,000 devices) and schedule rapid patching or compensating controls given that the advisory covers "all deployments regardless of system configuration."
  • Adversaries and threat actors: now have a published tactic and an IOC (%6a as "j") to reuse; Cisco's confirmation that exploitation is active increases the incentive for operators to probe SD‑WAN management interfaces for the same URI‑encoding bypass.

This advisory is the fifth SD‑WAN zero‑day actively exploited in the wild since the start of 2026. Cisco also warned in early June of two other exploited SD‑WAN zero‑days — CVE‑2026‑20245 and CVE‑2026‑20262 — that were abused to gain root privileges. Separate tracking by the Cybersecurity and Infrastructure Security Agency notes that since November 2021 it has tagged 90 Cisco vulnerabilities as exploited in the wild, including four in Cisco Catalyst SD‑WAN Manager and seven abused by ransomware operations.

The concrete next steps are narrow and immediate: upgrade to the fixed release Cisco has issued, scan the named logs for j_security_check and %6a indicators, collect admin‑tech files if compromise is suspected, and open a case with Cisco TAC. Cisco shared limited operational details about the ongoing attacks, but the combination of a universal‑impact authentication bypass and published IOCs means defenders have both a clear priority and measurable signals to hunt.

Original Cisco advisory, as reported by BleepingComputer

CiscoEmerging ThreatsNetwork SecurityZero-DaySD-WANNetwork ManagementCVE-2026-76504Administrative Privilege Escalation
Related Intelligence

Continue Reading

Person sitting at desk with laptop open, hands poised over keyboard.

Threat Actors Exploit ChatGPT Custom GPTs in ClickFix Malware Campaign

At least 40 users have fallen victim to a sneaky malware campaign that uses ChatGPT Custom GPT pages and Google Sites to spread a powerful remote access trojan (RAT). Attackers cleverly created fake Custom GPT links that appeared on Google search results, tricking users into downloading the malware.

Analyst 207
Network operations center with router configuration terminal and standard enterprise networking equipment.

Cisco SD-WAN Manager Flaw Exploited by Attackers

Cisco's SD-WAN Manager has a critical vulnerability that allows attackers to bypass authentication and access the Manager's API as an admin user without login credentials. This flaw, rated 9.8 out of 10 in severity, is being actively exploited, prompting Cisco to urge immediate upgrades to fixed releases.

Analyst 207
McDonald's restaurant interior with customers, focusing on blurred POS terminal and discarded paper near trash can.

McDonald's Customer Data Platform Breach Exposes 40M Records

If you're one of the 28 million McDonald's customers whose data was exposed, you may be at risk of social engineering scams and loyalty fraud due to the breach of sensitive info like names and loyalty point transactions. This massive data leak, which also included 71,000 corporate records, is a stark reminder to stay vigilant about protecting your personal data.

Analyst 207
Person sitting at a desk with a laptop surrounded by office supplies in a brightly lit office setting.

Browser Attacks Evolve, Exploit Gaps in Traditional Security Tools

Traditional security tools are struggling to keep up with the rapidly evolving world of phishing attacks, where 89% of malicious domains are active for less than two days, rendering blocklists almost useless. Sophisticated phishing kits and diverse delivery channels have made it easier for attackers to bypass multi-factor authentication and steal sensitive credentials.

Analyst 207