Cisco SD-WAN Vulnerability Actively Exploited — CISA Adds to KEV Catalog

A hex encoding vulnerability (CVE-2026-76504) in Cisco Catalyst SD-WAN Manager has been added to CISA's Known Exploited Vulnerabilities Catalog following evidence of active exploitation in the wild. This means threat actors are already leveraging this flaw, making unpatched systems an immediate and tangible risk rather than a theoretical one. Federal agencies are now mandated to remediate this vulnerability under Binding Operational Directive BOD 26-04, underscoring the critical importance of timely, risk-based patch management. Organizations that lack structured vulnerability prioritization programs are disproportionately exposed when widely-used network management platforms like SD-WAN controllers become active attack targets.

Tactical Insight

Immediate Actions

Apply the latest Cisco-issued patch or upgrade for Catalyst SD-WAN Manager without delay, prioritizing any internet-facing instances.
Run authenticated vulnerability scans across all SD-WAN infrastructure to identify exposed or unpatched nodes.
Restrict management-plane access to SD-WAN Manager using allowlists and firewall rules to reduce the attack surface while patching is underway.

Long-Term Improvements

Establish a formal vulnerability prioritization process that cross-references CVEs against the CISA KEV Catalog automatically.
Maintain a continuously updated inventory of all network appliances, software versions, and exposure status to accelerate future patch cycles.
Implement network segmentation to isolate SD-WAN management systems from general corporate traffic and the public internet.

Detection Measures

Enable centralized logging and SIEM alerting for anomalous authentication attempts or configuration changes on SD-WAN Manager.
Subscribe to CISA KEV Catalog feeds and vendor security advisories to receive real-time notification of newly exploited vulnerabilities.
Conduct regular threat-hunting exercises focused on network management platforms to detect post-exploitation indicators early.

Framework References

CIS Control 7: Continuous Vulnerability ManagementCIS Control 12: Network Infrastructure ManagementCIS Control 13: Network Monitoring and DefenseNIST SP 800-40 Rev. 4: Guide to Enterprise Patch ManagementNIST SI-2: Flaw RemediationNIST RA-5: Vulnerability Monitoring and ScanningNIST SC-7: Boundary Protection (Network Segmentation)CISA Binding Operational Directive BOD 22-01: Known Exploited VulnerabilitiesCISA Binding Operational Directive BOD 26-04: Risk-Based Vulnerability ManagementITIL 4: Change Enablement / Vulnerability Management PracticeISO/IEC 27001:2022 Annex A 8.8: Management of Technical Vulnerabilities

Source

ThreatNoir coverageCISA Adds One Known Exploited Vulnerability to Catalog Read originalCISA Adds One Known Exploited Vulnerability to Catalog

PublishedSep 30, 2026