No. 062CISA KEV · 3 sources
Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability Added to CISA KEV
CISA added CVE-2026-76504, a hex encoding vulnerability in Cisco Catalyst SD-WAN Manager, to the Known Exploited Vulnerabilities Catalog with a 3 October 2026 federal remediation due date.
On this page
What's on the official record
30 September — CISA added CVE-2026-76504 to the KEV catalog. The record describes a hex encoding vulnerability in Cisco Catalyst SD-WAN Manager (CWE-177) that could allow an unauthenticated, remote attacker to access an affected system with the privileges of the admin user, due to improper handling of URI encoding in an HTTP request. CISA's dateAdded is 30 September 2026 and the remediation due date for federal civilian agencies is 3 October 2026, in catalog version 2026.10.21. The record names no fixed version, pointing instead to the vendor advisory. The catalog does not record known ransomware use. FIRST's EPSS model estimates a 0.018 probability of exploitation (79th percentile, 2026-10-23). CISA's ADP records SSVC exploitation as active, automatable yes, impact total.
Assessment
For a platform or AI-stack owner, the record lets you check whether Cisco Catalyst SD-WAN Manager instances in your estate are covered by the vendor advisory, since the catalog names no fixed version. The catalog records active exploitation, so the record supports isolating affected systems or applying the vendor's mitigations before a version comparison is possible.
For a cyber underwriter, the record lets you check policyholders' Cisco Catalyst SD-WAN Manager estates against the vendor advisory, since no fixed version is named. The catalog does not record known ransomware use, so ransomware exposure is not established by this record; the record supports requiring the vendor's mitigations as a control.
What would change this call
- A fixed version named by Cisco or the CVE record would turn the check from applying the vendor advisory into a specific version comparison.
- A ransomware association recorded in the catalog would change the underwriter's exposure framing.
What to check next
| Check | Why |
|---|---|
| Whether Cisco Catalyst SD-WAN Manager instances are covered by the vendor advisory | The record names no fixed version, so the advisory is the only remediation reference |
| Whether the vendor's mitigations have been applied or affected systems isolated | The catalog records active exploitation and total impact |
Confidence
Filed 25 October 2026 from the record dated 30 September 2026.
Sources
[1] Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-76504
[2] CVE record CVE-2026-76504 — https://www.cve.org/CVERecord?id=CVE-2026-76504
[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Entry
- 062
- Published
- Record
- CISA KEV · 3 sources
- Written for
AI assistants read this note with get_note cyb-20260930-cve-2026-76504. Connect yours