20.18.4[.]1IP address
Reported by 7 independent sources · first reported by Cisco PSIRT · last reported
Last reported 23 days ago
What the reports say
7 reports, newest first · the exact sentence from each-
CVE-2026-76504: Cisco SD-WAN Flaw Exploited“20.18.4[.]1”
-
Cisco security advisory (AV26-978)“Versions prior to 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4[.]1, 26.1.2.1 et 26.2.1”
-
Cisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability“CVE-2026-76504 was resolved in Catalyst SD-WAN versions 26.2.1, 26.1.2.1, 20.18.4[.]1, 20.15.6.1, 20.12.8.2, and 20.9.10.1.”
-
Omisión de autenticación en Catalyst SD-WAN Manager de Cisco“20.18, anteriores a la 20.18.4[.]1;”
-
Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager“20.18.4[.]1”
-
Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)“20.18.4[.]1”
-
Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability“20.18.4[.]1”
Indicators reported together
named in the same reports- 20.12.8[.]2in 7 reports
- 20.15.6[.]1in 7 reports
- 26.1.2[.]1in 7 reports
- 20.9.10[.]1in 6 reports
Copy these 4 indicators · defanged
Also named with it: CVE-2026-76504, CVE-2026-20182, CVE-2026-20245, CVE-2026-20262, CVE-2026-20127
Thanks — we review every report.