Cisco has confirmed that attackers are already exploiting a critical flaw in its Catalyst SD-WAN Manager, the software used to control business wide-area networks. The US cyber agency CISA has added it to its list of actively exploited vulnerabilities.

• What it is: A login bypass (CVE-2026-76504, rated 9.8 out of 10) that lets an attacker send a specially crafted web request and gain administrator access without a password.
• Who is affected: Organisations running Cisco Catalyst SD-WAN Manager, including managed service customers whose provider uses it to run their branch networks.
• The risk: An attacker with administrator access could change network settings, intercept traffic or move deeper into your systems.
• What to do: Install the fixed Cisco release as soon as possible, restrict management access to trusted addresses only, and review access logs for unfamiliar activity since September.

If your business uses Cisco SD-WAN, we recommend asking your network provider today to confirm the update has been applied. Source: The Hacker News.