On September 30, 2026, CISA reported adding CVE-2026-76504 to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is described as a hexadecimal encoding issue in Cisco Catalyst SD-WAN Manager, with evidence of active exploitation.
The agency says vulnerabilities of this kind are a frequent attack vector and pose significant risks to the federal sector. Directive BOD 26-04 requires Federal Civilian Executive Branch agencies to prioritize, on a risk basis, remediation of KEV-listed vulnerabilities on publicly exposed assets where exploitation could grant full control of the asset. It also sets expectations for checking for possible compromise before applying fixes.
The directive applies only to FCEB agencies. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize fixing flaws listed in KEV. For possible catalog inclusion, the agency requests a CVE ID, evidence of exploitation, and clear mitigation guidance.
Consult CISA’s alert and the corresponding KEV entry to confirm the details and check for updated vendor guidance. The source text is an automatic translation; compare it with the original notice before making decisions. If you use AI to analyze the material, avoid entering internal data or credentials and follow your organization’s policies.