NewsThe Hacker News2026-09-30 15:24 UTCEnergy & Utilities Public Sector

Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager

Attackers are exploiting a new critical zero-day flaw in Cisco Catalyst SD-WAN Manager, the system companies use to manage their Cisco SD-WAN networks, Cisco said in an advisory on September 30. The flaw, CVE-2026-76504, could allow a remote attacker with no login access to use the Manager's API as the admin user. Fixed releases are available, and there is no workaround. It carries a

CVE-2026-76504Cisco Catalyst SD-WAN Manager — Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
CVE-2026-76504Eine Schwachstelle in der API-sitzungsbasierten Authentifizierungsverwaltung von Cisco Catalyst SD-WAN Manager könnte es einem nicht authent...
CVE-2026-76504Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability
CVE-2026-76504Cisco Catalyst SD-WAN Manager: Schwachstelle ermöglicht Erlangen von Administratorrechten

Other advisories

CVE-2026-62367none
go code.vikunja.io/api: Authentication Bypass by Spoofing
ghsa:GHSA-4hv6-xc92-j86gmedium
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
osv:GHSA-4hv6-xc92-j86gnone
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
CVE-2026-62367none
go code.vikunja.io/api: Authentication Bypass by Spoofing
CVE-2026-107808none
Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
CVE-2026-107808high
Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
osv:GHSA-r44w-v6gf-x3p6none
pyLoad has an authentication bypass in API key validation (check_apikey cache)
ghsa:GHSA-r44w-v6gf-x3p6high
pyLoad has an authentication bypass in API key validation (check_apikey cache)

Other news entries

Newsthehackernews2026-10-09
Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access
Newssecurityweek2026-10-09
Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
Newssecurityweek2026-10-08
SonicWall and Splunk Patch Critical Vulnerabilities
Newscsoonline2026-10-08
SonicWall’s latest critical flaw indicates a security pattern, not another one-off bug
Newsthehackernews2026-10-07
SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances
Newsbleepingcomputer2026-10-07
Hackers exploit critical Atlassian flaw after public PoC release
Newsbleepingcomputer2026-10-06
Fake ChatGPT, Gemini Sites steal advertising accounts, MFA codes
Newssecurityweek2026-10-03
Fortra Patches Critical Vulnerabilities in BoKS

Source: https://thehackernews.com/2026/09/cisco-warns-of-attackers-exploiting.html

Linked advisories

More on Authentication