Catalyst SD-WAN Manager (Product): news timeline & CVEs

Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

CISA added exploited FortiMail flaw CVE-2026-104286, a critical unauthenticated file-write bug, to the KEV catalog.

CISA added Fortinet FortiMail CVE-2026-104286, a CVSS 9.8 path-traversal and NULL-byte flaw, to the Known Exploited Vulnerabilities catalog after confirmed active exploitation. An unauthenticated attacker can write arbitrary files via crafted HTTP or HTTPS requests. Affected branches are FortiMail 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, and 7.2.0-7.2.9, with some fixes still upcoming. Until patches ship, Fortinet advises disabling IBE and restricting management access; federal agencies must mitigate by October 4, 2026.

The Hacker NewsOct 2, 05:49 UTC · 18h agoExploit / PoC in the wildCVE-2026-104286 CVE-2026-85102 CVE-2026-93616+5 CVEs2

CVE-2026-76504: Cisco SD-WAN Flaw Exploited

Cisco says critical Catalyst SD-WAN Manager authentication bypass CVE-2026-76504 is being exploited.

Cisco disclosed CVE-2026-76504, a critical authentication bypass in Catalyst SD-WAN Manager, formerly vManage. The published text says the flaw allows an unauthenticated attacker to proceed, but the remainder of the description is truncated. The headline states that the vulnerability is being exploited. Defenders running SD-WAN Manager should treat the issue as an active authentication-bypass risk and apply Cisco's fix as soon as it is available.

SOCRadarupdated Oct 1, 14:30 UTC · 1d agofirst Oct 1, 12:22 UTC · 1d agoExploit / PoC in the wild 16 sources CVE-2026-76504

Cisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability

Cisco patched CVE-2026-76504, a critical Catalyst SD-WAN Manager auth bypass exploited in the wild and added to KEV.

Cisco patched CVE-2026-76504, a CVSS 9.8 authentication bypass in Catalyst SD-WAN Manager that was exploited in the wild. Improper URI encoding lets a remote unauthenticated attacker send a crafted HTTP request and access a restricted API as admin. All deployments are affected and Cisco says there are no workarounds; fixed releases include 26.2.1, 26.1.2.1, 20.18.4.1, 20.15.6.1, 20.12.8.2, and 20.9.10.1. CISA added the flaw to the KEV catalog and told federal agencies to patch within three days.

SecurityWeekupdated Oct 1, 14:30 UTC · 1d agofirst Oct 1, 08:26 UTC · 1d agoExploit / PoC in the wild 16 sources CVE-2026-765041

Cisco warns of new SD-WAN zero-day exploited in attacks

Cisco says attackers are exploiting critical SD-WAN Manager auth-bypass zero-day CVE-2026-76504.

Cisco released fixes for CVE-2026-76504, a critical authentication bypass in Catalyst SD-WAN Manager, formerly vManage, that unauthenticated attackers are actively exploiting to gain administrator privileges. Improper URI-encoding handling lets a crafted HTTP request skip an authentication rule on a specific API endpoint, and every deployment is affected regardless of configuration. Cisco PSIRT learned of exploitation in September 2026 and cited malicious use of %6a for the character "j" plus suspicious j_security_check entries in serviceproxy-access.log and vmanage-server.log. Fixed versions include 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1; it is the fifth SD-WAN zero-day exploited in 2026, after CVE-2026-20127, CVE-2026-20182, CVE-2026-20245, and CVE-2026-20262.

BleepingComputerupdated Oct 1, 14:30 UTC · 1d agofirst Sep 30, 14:46 UTC · 2d agoExploit / PoC in the wild 16 sources CVE-2026-76504

Catalyst SD-WAN Manager

Timeline4 articles

Related CVEsby mentions

Appears with

Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

CVE-2026-76504: Cisco SD-WAN Flaw Exploited

Cisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability

Cisco warns of new SD-WAN zero-day exploited in attacks