None

Cisco has patched CVE-2026-76504, an exploited zero-day authentication bypass vulnerability in Catalyst SD-WAN.

TAIPEI, Taiwan — October 22, 2026 — Following a thorough investigation, the Synology Product Security Incident Response Team (PSIRT) has confirmed tha Continue reading... - - - Source: synology.com

On October 21, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the following advisories. To remediate the vulnerabilities that were disclosed on October 21, 2026, Cisco stron...

A panel of vulnerability management experts will explore how to move beyond broad metrics like CVSS to prioritize vulnerabilities, make practical remediation decisions and verify that risks have been effectively addressed

Synology hat eine Stellungnahme zu den kürzlich bekannt gewordenen PHP2Shell-Schwachstellen (CVE-2026-109618 und CVE-2026-109619) veröffentlicht. Nach einer Untersuchung durch das hauseigene Sicherheitsteam (PSIRT) steht fest, dass die... Zum Beitrag: Synology: Sicherheitsupdates für PHP gegen PHP2Shell-Lücken Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads **Auf dem Laufenden bleiben?** Fügt uns doch bei Google als bevorzugte Quelle hinzu!

Fortinet Releases Security Hardening Release for Multiple ProductsFortinet은 FortiOS, FortiManager, FortiAnalyzer 등 다수 제품에 대해 10월 22일 보안 강화 업데이트를 배포하며, 인터넷 노출 장비의 즉각적인 패치를 권고했다. 이번 릴리스에는 AI 지원 보안 테스트로 발견한 중요·고위험 취약점 수정이 포함되지만, 개별 CVE와 기술 세부사항은 11월 10일 PSIRT 공지 전까지 공개되지 않는다. 벤더는 공개 패치의 diff 분석과 AI 기반 취약점 체이닝으로 익스플로잇 무기화 시간이 수일...https://www.fortinet.com/blog/ciso-collective/fortinet-releases-security-hardening-release-for-multiple-products

Why signed firmware can still carry risk, and how OT operators can assess vendors on transparency, PSIRT maturity, and jurisdiction under NIS2 and the CRA.

GMOサイバーセキュリティ byイエラエ株式会社と株式会社マクニカは9月29日、中小製造業の製品セキュリティに必要な品質確保体制構築・実務運用・教育を一体的に支援するサービスプラットフォーム「monosec360」を同日から提供開始すると発表した。

None

None

Moxa se dit prêt pour l’obligation du CRA de signaler sous 24 h vulnérabilités exploitées et incidents graves, grâce à son PSIRT et à ses SBOM.

Cisco warned customers to patch a critical Secure Email Gateway zero-day security flaw that threat actors have been exploiting in attacks.

## Summary On September 30, 2026, Cisco published advisory **cisco-sa-sdwan-webauth-xr8beuuU** for **CVE-2026-76504** , an authentication bypass in Cisco Catalyst SD-WAN Manager rated **CVSS 9.8 (Critical)**. A remote attacker with no credentials can gain **admin-level API access with a single crafted HTTP request** — by percent-encoding one character in the request URI. Cisco's own PSIRT confirmed the flaw was **actively exploited in September 2026** , discovered during a real TAC support case. CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a federal patch deadline of October 3. There are no workarounds. One SD-WAN Manager instance can administer up to **6,000 devices** — so admin API access here reaches every branch office, every WAN edge, everything. ## Severity * **CVE ID:** CVE-2026-76504 * **Title:** Cisco Catalyst SD-WAN Manager authentication bypass vulnerability * **CVSS 3.1:** 9.8 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * **Weakness:** CWE-177 — improper handling of URL encoding (hex encoding) * **Attack requirements:** None — unauthenticated, remote, single request * **Exploited in the wild:** Yes — confirmed by Cisco PSIRT, active exploitation in September 2026 * **CISA KEV:** Added September 30, 2026 — federal deadline October 3 The vector is the maximum: network-accessible, low complexity, **no privileges, no user interaction** , full impact on confidentiality, integrity, and availability. A 9.8 that is both actively exploited and KEV-listed is the highest-priority class of vulnerability a defender will see this year. ## Affected Versions Cisco Catalyst SD-WAN Manager is affected **regardless of configuration** — there is no setting that avoids this. Fixed releases: * **20.9 branch** — fixed in 20.9.10.1 * **20.12 branch** — fixed in 20.12.8.2 * **20.15 branch** — fixed in 20.15.6.1 (cloud-hosted 20.15.605 was already fixed) * **20.18 branch** — fixed in 20.18.4.1 * **26.1 branch** — fixed in 26.1.2.1 * **26.2 branch** — fixed in 26.2.1 **Releases earlier than 20.9 have no fix — you must migrate** to a supported release. Check your version with the standard CLI/GUI version commands on the Manager; if the Manager is internet-reachable and below a fixed build, treat it as compromised until proven otherwise. ## Technical Analysis **The one-character bypass.** The root cause is CWE-177: improper handling of URL encoding in the API's session-based authentication. Here is the mechanism, reconstructed from the advisory's description. The authentication layer guards a sensitive endpoint — the **j_security_check** login-check path — with a filter that does a **literal string match** on the request URI. The attacker percent-encodes a single character of that path, for example sending **%6a** (the hex encoding of the letter "j") instead of the literal "j". The filter compares the raw, still-encoded string against its rule, finds no match, and waves the request through as if it needed no authentication. The backend then **decodes the URI before routing** , sees the real protected endpoint, and serves it — with the request now treated as privileged. Two components disagree about what the request _is_ , and the attacker's request slips through the gap between them. **Why this bug class never dies.** Encoding-normalization mismatches are one of the oldest tricks in web security — directory traversal via %2e%2e, filter evasion via double-encoding, the classics. They keep recurring because the fix is architectural, not local: _every_ layer that inspects a request must agree on the canonical form of that request before any security decision is made. A filter that matches on the raw string while the router decodes first is a design flaw, not a typo — and it survives code review because each component looks correct in isolation. Cisco shipping this in 2026, in the management plane of its flagship SD-WAN product, shows that even mature vendors still get canonicalization wrong at security boundaries. **Admin API access is total access.** This is not a read-only leak or a limited privilege gain. The attacker lands with **administrator-level API access** to the SD-WAN Manager — the single pane of glass that provisions, monitors, and configures the entire SD-WAN fabric. One Manager can oversee up to 6,000 devices. From that position an attacker can push configuration to every branch router, harvest device credentials, alter routing policy to redirect traffic, or use the management network as a launchpad into the enterprise. The blast radius of one HTTP request is the whole WAN. **Found in a support case, not a lab.** Cisco PSIRT became aware of active exploitation through a **TAC support case** — meaning a real customer, with a real incident, brought the evidence to Cisco. Exploitation-in-the-wild was not a theoretical forecast; it was already happening before the advisory existed. Combined with the CISA KEV listing on day one and a three-day federal patch deadline, the message to every other SD-WAN Manager operator is blunt: attackers already had this before you heard about it. The question is not whether your instance was probed, but whether it was exploited — and the detection guidance below is how you start answering that. **Detection: read the logs like an attacker.** Cisco's advisory points defenders at two log sources: **serviceproxy-access.log** and **vmanage-server.log**. Look for requests to **j_security_check** containing **percent-encoded characters** (such as %6a) arriving from unknown or unexpected IP addresses — that is the fingerprint of this bypass. Separately, watch for suspicious activity by internal service accounts, particularly ones named **viptela-reserved-** *, which attackers may abuse or impersonate after gaining access. If those logs are not retained or not centralized, fix that first — you cannot investigate an incident you cannot see. Note that legitimate traffic to these endpoints is rare, which makes the signal-to-noise ratio unusually favorable: encoded requests to the auth endpoint from unfamiliar sources are worth treating as hostile until proven otherwise. ## Why This Matters SD-WAN Manager is the control plane of the wide-area network. Compromising a control plane is categorically worse than compromising a single device, because the control plane _defines_ what the network does. An attacker with admin API access does not need to hack 6,000 routers — they can simply ask the Manager to reconfigure them. And because this flaw needs no credentials and a single request, it is trivially scannable: every internet-exposed Manager on the planet could have been fingerprinted within days of disclosure. This also fits this month's grim pattern of broken access control in enterprise infrastructure — alongside the Exchange authorization flaw covered earlier this month. Different vendors, different products, same root story: the code that decides _who is allowed_ keeps failing, and the failures keep being remotely exploitable. ## Mitigation * **Patch now — no workarounds exist.** Upgrade to the fixed release on your branch (20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, or 26.2.1). If you are on a release earlier than 20.9, plan the migration immediately — there is no patch coming for those branches. * **Assume breach if you were exposed.** If your Manager was internet-reachable and unpatched at any point in September, do not just patch and move on. Audit serviceproxy-access.log and vmanage-server.log for encoded j_security_check requests from unknown IPs, and review activity by viptela-reserved-* service accounts. * **Rotate credentials across the fabric.** Admin API access can harvest device credentials and session material. Rotate Manager admin credentials, API tokens, and device credentials managed through the fabric — not just the Manager's own password. * **Restrict management-plane exposure.** SD-WAN Manager has no business being broadly reachable from the internet. After patching, lock management access behind VPN or strict allow-lists. The next control-plane flaw should find no exposed target. * **Meet the KEV deadline — then beat it.** CISA's federal deadline was October 3. If you are still unpatched, you are already past the line the US government drew for its own agencies. Treat that as the signal it is. ## References * Cisco security advisory cisco-sa-sdwan-webauth-xr8beuuU — CVE-2026-76504 (published September 30, 2026) * CISA Known Exploited Vulnerabilities catalog — CVE-2026-76504 (added September 30, 2026) * NVD entry for CVE-2026-76504 (CWE-177) Report by Faizan Akhtar — The Cyber Security Researcher