Our automated tracking framework flagged that CISA added CVE-2026-76504 (Cisco Catalyst SD-WAN Manager) to the Known Exploited Vulnerabilities (KEV) catalog on October 1, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-76504 by October 3, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-76504 |
| Vendor / product | Cisco Catalyst SD-WAN Manager |
| Vulnerability | Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability |
| CVSS base score | 9.8 |
| Added to KEV | September 30, 2026 |
| Days public before listing (NVD → KEV lag) | 0 |
| Federal patch deadline | October 3, 2026 |
| Known ransomware use | No |
How This Compares to Cisco’s Track Record
This one was listed on or before its public disclosure (a lag of 0 days) — a zero-day exploited at or before the vulnerability was even published. Cisco currently ranks #10 on our KEV Lag leaderboard.
| Cisco in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 100 |
| Median lag (public → KEV listing) | 1074 days |
| 0-day rate (exploited at or before disclosure) | 17% |
| Entries tied to known ransomware campaigns | 6 |
For perspective, the median across all 1730 tracked KEV entries is 245 days — Cisco’s exploited vulnerabilities are flagged slower than the catalog average.
Other Recent Cisco KEV Additions
The most recent Cisco vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-76460 | Identity Services Engine | September 16, 2026 | 0 | No |
| CVE-2026-76461 | Secure Email Gateway | September 14, 2026 | 0 | No |
| CVE-2026-20079 | Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management | September 9, 2026 | 189 | No |
| CVE-2026-20349 | Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | August 11, 2026 | 0 | No |
| CVE-2026-20316 | Secure Firewall Management Center (FMC) | July 29, 2026 | 0 | No |
Defense guide: How to Detect Zero-day Vulnerability: Attack Chain & Defense — detection signals, attack chain and response steps for this class of attack.
What This Means for Defenders
CISA has added CVE-2026-76504, a Hex Encoding Vulnerability in Cisco Catalyst SD-WAN Manager, to its Known Exploited Vulnerabilities (KEV) catalog. With a CVSS base score of 9.8, this vulnerability poses a critical risk, demanding immediate attention from all organizations using Cisco Catalyst SD-WAN Manager. The federal patch deadline is tight, set for October 3, 2026, just three days after its KEV listing on September 30, 2026. This compressed timeline suggests the severity of the flaw.
The most striking aspect of this KEV entry is the zero-day lag. CVE-2026-76504 was added to the KEV catalog on the same day it became publicly known, indicating active exploitation before public disclosure. There wasn’t any detection window for most organizations prior to the KEV listing. Organizations with these systems are highly exposed and should patch immediately.
Patching must be the top priority. Patch before October 3, 2026. If immediate patching isn’t feasible, security teams must implement compensating controls, including isolating affected systems and enhancing network segmentation to monitor for suspicious activity targeting Cisco Catalyst SD-WAN Manager environments.
Related Coverage
- Cisco’s CVE-2026-20316 Was Exploited in 0 Days — Well Under Its 1245-Day Median (July 2026)
- Cisco’s CVE-2026-20349 Was Exploited in 0 Days — Well Under Its 1245-Day Median (August 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
