If your business uses Cisco Catalyst SD-WAN Manager to run its wide-area network, Cisco has confirmed a critical, actively-exploited authentication-bypass flaw with no workaround — patching is the only fix, and it’s worth doing now rather than at your next scheduled maintenance window.
What’s been confirmed
Cisco has disclosed CVE-2026-76504, a critical authentication-bypass vulnerability in Catalyst SD-WAN Manager, rated 9.8 out of 10 on the severity scale — close to the maximum possible. Cisco’s own security advisory confirms the flaw allows an attacker to bypass authentication entirely, and critically, there is no workaround available: the only way to close the hole is to apply Cisco’s patch. This is a different product and a different vulnerability to the Cisco/SonicWall issues already covered on this blog (which involved SMA1000 VPN appliances, Cisco FMC, and Cisco’s Secure Email Gateway) — if your business runs SD-WAN Manager specifically, this is a separate thing to check.
Why SD-WAN Manager is a meaningful target
SD-WAN Manager is the control-plane system that manages how traffic is routed across a business’s wide-area network — effectively the management console sitting above the networking gear itself. An authentication bypass here doesn’t just risk one device; it risks the administrative control point for how your entire network is configured. For a business running multiple sites connected over SD-WAN, that’s a single point that, if compromised, has outsized reach into how the whole network behaves.
What to check this week
1. Confirm whether your business runs Cisco Catalyst SD-WAN Manager (as opposed to other Cisco SD-WAN components) — this specific flaw is in the Manager component. 2. If you do, check your version against Cisco’s published fixed versions in the security advisory for CVE-2026-76504 and apply the patch as a priority, not as part of routine maintenance. 3. Because there’s no workaround, don’t rely on compensating controls like extra firewall rules as a substitute for patching — Cisco’s advisory is explicit that the patch is the only fix.
A “no workaround, patch now” advisory for a 9.8-severity authentication bypass on a network management system is about as clear a priority signal as vendor advisories get. If you’re not sure whether your SD-WAN setup is affected, or want someone to confirm the patch has actually been applied correctly, our cybersecurity team can check it directly rather than you having to interpret the advisory yourself.
Cisco’s full security advisory, including affected versions and the patch, is published on its security advisory page.
When a vendor says there’s no workaround for an actively-exploited authentication bypass, that’s not a detail to file away for later — it’s the entire instruction.