Cisco says attackers are actively exploiting a critical authentication bypass in Catalyst SD-WAN Manager, the controller many large networks use to run their software-defined WANs. The bug is CVE-2026-76504. A crafted HTTP request can skip the login check and reach the API as the admin user.

Photo: Ed Schipul / Wikimedia Commons (CC BY-SA 2.0), cropped