ctrlINT What the industry said about every indicator, with the quote

CVE-2026-76504Vulnerability

Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .

Reported by 16 independent sources · first reported by CISA advisories · last reported

Last reported 12 days ago

CISA KEVAdded 30 Sep 2026
Fix due 3 Oct 2026
Used by ransomware: not knownCISA KEV catalogue
EPSS1.8%
higher than 78% of CVEsFIRST EPSS, as of 23 Oct 2026

What the reports say

21 reports · the newest 20, newest first · the exact sentence from each

  1. “CVE-2026-76504”

    Recorded FutureVendor
    September 2026 CVE Landscape

  2. “…026-93302, CVE-2026-89102 (WolfSSL), CVE-2026-84782 (OpenSSL), CVE-2026-12530, CVE-2026-16796 (Amazon Bedrock AgentCore Python SDK), CVE-2026-76504 (Cisco Catalyst SD-WAN Manager), CVE-2026-84411 (MikroTik RouterOS), CVE-2026-19743, CVE-2026-92368, CVE-2026-92369, CVE-2026-92370,…”

    The Hacker NewsNews
    ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests

  3. “Cisco has alerted about CVE-2026-76504, a critical (CVSS 9.8) vulnerability in Catalyst SD-WAN Manager.”

    Check Point ResearchVendor
    5th October – Threat Intelligence Report

  4. “CVE-2026-76504”

    CERT-FRGovernment
    Bulletin d'actualité CERTFR-2026-ACT-042 (05 octobre 2026)

  5. “New Cisco SD-WAN zero-day exploited in-the-wild (CVE-2026-76504)”

    Help Net SecurityNews
    Week in review: Researcher breaks into Microsoft analytics service, NetScaler RCE 0-day exploited

  6. “…6), Arista VeloCloud Orchestrator (CVE-2026-93952), F5 BIG-IP Access Policy Manager (CVE-2026-94127), Cisco Catalyst SD-WAN Manager (CVE-2026-76504), and Citrix NetScaler ADC and NetScaler Gateway (CVE-2026-88771 and CVE-2026-88772) have come under in-the-wild exploitation.”

    The Hacker NewsNews
    Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

  7. “[Cisco CVE-2026-76504]”

    Risky Business NewsNews
    Risky Bulletin: Authorities dismantle KillSec group, arrest members across Europe

  8. “In a security advisory published on September 30, Cisco issued a warning about CVE-2026-76504, a vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager which could allow an unauthenticated, remote attacker to access an affected system wi…”

    Infosecurity MagazineNews
    Critical Cisco Catalyst SD-WAN Zero-Day Under Active Exploitation

  9. “CVE-2026-76504: Cisco SD-WAN Flaw Exploited”

    SOCRadarVendor
    CVE-2026-76504: Cisco SD-WAN Flaw Exploited

  10. “On September 30, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76504 to their Known Exploited Vulnerabilities (KEV) Database.”

    Canadian Centre for Cyber SecurityGovernment
    Cisco security advisory (AV26-978)

  11. “The vulnerability, tracked as CVE-2026-76504 (CVSS score: 9.8), could allow an unauthenticated, remote attacker to access an affected system with the privileges of the admin user.”

    The Hacker NewsNews
    CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV

  12. “New Cisco SD-WAN zero-day exploited in-the-wild (CVE-2026-76504)”

    Help Net SecurityNews
    New Cisco SD-WAN zero-day exploited in-the-wild (CVE-2026-76504)

  13. “Cybersecurity and Infrastructure Security Agency (CISA) added a Cisco Catalyst SD-WAN Manager flaw, tracked as CVE-2026-76504 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog.”

    Security AffairsNews
    U.S. CISA adds Cisco Catalyst SD-WAN Manager flaw to its Known Exploited Vulnerabilities catalog

  14. “Tracked as CVE-2026-76504 (CVSS score of 9.8), the flaw impacts the API session-based authentication mechanism and could allow remote, unauthenticated attackers to gain administrative access to a vulnerable system.”

    SecurityWeekNews
    Cisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability

  15. “Cisco ha confirmado la explotación activa de CVE-2026-76504.”

    INCIBE-CERTGovernment
    Omisión de autenticación en Catalyst SD-WAN Manager de Cisco

  16. “CVE-2026-76504 | Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability | Reversed by Horizon3”

    Horizon3.aiVendor
    CVE-2026-76504 | Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability | Reversed by Horizon3

  17. “Cisco indique que la vulnérabilité CVE-2026-76504 est activement exploitée.”

    CERT-FRGovernment
    Vulnérabilité dans Cisco Catalyst SD-WAN (01 octobre 2026)

  18. “The flaw, CVE-2026-76504, could allow a remote attacker with no login access to use the Manager's API as the admin user.”

    The Hacker NewsNews
    Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager

  19. “Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)”

    Rapid7Vendor
    Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)

  20. “CVE-2026-76504 Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability”

    CISA advisoriesGovernment
    CISA Adds One Known Exploited Vulnerability to Catalog

Indicators reported together

named in the same reports
Copy these 6 indicators · defanged

Also named with it: CVE-2026-88771, CVE-2026-88772, CVE-2026-86950, CVE-2026-104286, CVE-2026-81963, CVE-2026-81578, CVE-2026-82078, CVE-2026-76460, CVE-2026-93616, CVE-2026-94127, CVE-2026-89078, CVE-2026-93577, CVE-2026-85102, CVE-2026-93952

Thanks — we review every report.

Report a wrong value
What is wrong with CVE-2026-76504 here?
No account needed. We do not store your IP address.