{"metadata": {"vulnerability": "CVE-2026-76504", "count": 178, "kinds": {"milestone": 8, "sighting": 134, "kev": 17, "other": 19}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0395", "record": "NCSC-2026-0395", "field": "document.tracking.generator.date"}, {"timestamp": "2026-08-19T12:02:03.641Z", "date_only": false, "value": "2026-08-19T12:02:03.641Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-76504", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-30T00:00:00Z", "date_only": false, "value": "2026-09-30T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-76504", "field": "timestamps.asserted_at", "uuid": "f5bc2a87-dc34-47c6-ac53-71cf2a28f1ac", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-30T00:00:00Z", "date_only": true, "value": "2026-09-30", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-76504", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-09-30T00:00:00Z", "date_only": true, "value": "2026-09-30", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-76504", "field": "evidence.0.details.date_added", "uuid": "f5bc2a87-dc34-47c6-ac53-71cf2a28f1ac", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-30T00:00:00Z", "date_only": false, "value": "2026-09-30T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-76504", "field": "timestamps.first_seen_at", "uuid": "f5bc2a87-dc34-47c6-ac53-71cf2a28f1ac", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-30T00:00:00Z", "date_only": true, "value": "2026-09-30", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1246", "record": "CERTFR-2026-AVI-1246", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-09-30T00:00:00Z", "date_only": false, "value": "2026-09-30T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-76504", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-30T00:00:00Z", "date_only": false, "value": "2026-09-30T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-76504", "record": "FKIE_CVE-2026-76504", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-30T00:00:00Z", "date_only": false, "value": "2026-09-30T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-76504", "field": "status.status_updated_at", "uuid": "f5bc2a87-dc34-47c6-ac53-71cf2a28f1ac", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-30T00:00:00Z", "date_only": false, "value": "2026-09-30T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-76504", "field": "containers.adp.0.timeline.0.time"}, {"timestamp": "2026-09-30T07:01:45Z", "date_only": false, "value": "2026-09-30T07:01:45.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-31", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "1e81a6e2-4884-4a50-a5d3-df4ff07c69f3", "url": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-31"}, {"timestamp": "2026-09-30T11:42:55Z", "date_only": false, "value": "2026-09-30T11:42:55.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/cisco-rilevato-sfruttamento-in-rete-di-una-vulnerabilita-in-catalyst-sd-wan-manager", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "63884acf-3b06-4cee-8b54-7cb0a8fefb61", "content": "Cisco ha rilevato lo sfruttamento in rete di una vulnerabilit\u00e0 critica, identificata tramite la CVE-2026-76504, in Cisco Catalyst SD-WAN Manager, soluzione per la gestione di ambienti SD-WAN.", "url": "https://www.acn.gov.it/portale/w/cisco-rilevato-sfruttamento-in-rete-di-una-vulnerabilita-in-catalyst-sd-wan-manager"}, {"timestamp": "2026-09-30T12:46:40Z", "date_only": false, "value": "2026-09-30T12:46:40.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.bleepingcomputer.com/news/security/cisco-warns-of-new-sd-wan-authentication-bypass-zero-day-exploited-in-attacks/", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "e3145b51-8a14-4db8-b07f-e26d6d3522a8", "content": "Cisco\u00a0released security updates to address a critical zero-day in the Catalyst SD-WAN Manager (tracked as\u00a0CVE-2026-76504) that attackers are actively exploiting to\u00a0escalate to admin privileges. [...]", "url": "https://www.bleepingcomputer.com/news/security/cisco-warns-of-new-sd-wan-authentication-bypass-zero-day-exploited-in-attacks/"}, {"timestamp": "2026-09-30T12:55:52Z", "date_only": false, "value": "2026-09-30T12:55:52+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-SDWAN-WEBAUTH-XR8BEUUU", "record": "CISCO-SA-SDWAN-WEBAUTH-XR8BEUUU", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-09-30T13:00:00Z", "date_only": false, "value": "2026-09-30T13:00:00+00:00", "kind": "milestone", "label": "Published", "source": "csaf_cisco \u00b7 CISCO-SA-SDWAN-WEBAUTH-XR8BEUUU", "record": "CISCO-SA-SDWAN-WEBAUTH-XR8BEUUU", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-09-30T13:04:32.095Z", "date_only": false, "value": "2026-09-30T13:04:32.095Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-76504", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-30T13:13:40.282Z", "date_only": false, "value": "2026-09-30T13:13:40.282937Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mwqgcp36il24", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "ea3c32c3-d65f-4568-b51c-9c8d398eceb5", "content": "Cisco Catalyst SD-WAN Manager CVE-2026-76504, CVSS 9.8: unauthenticated API bypass to admin, exploited in the wild per Cisco. No workaround. Upgrade to 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 or 26.2.1. https://cti.securitycyber.uk", "url": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mwqgcp36il24"}, {"timestamp": "2026-09-30T13:17:20Z", "date_only": false, "value": "2026-09-30T13:17:20Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-XQJC-V467-8FVF", "record": "GHSA-XQJC-V467-8FVF", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-30T13:17:20.247Z", "date_only": false, "value": "2026-09-30T13:17:20.247", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-76504", "record": "FKIE_CVE-2026-76504", "field": "published"}, {"timestamp": "2026-09-30T13:17:47.040Z", "date_only": false, "value": "2026-09-30T13:17:47.040778Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3mwqgjzyjqi2r", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "d82e9c6c-175f-4075-a1a4-85d8c4a50ad3", "content": "\ud83d\udd34 EXPLOITED\n\nCVE-2026-76504: Cisco Catalyst SD-WAN Manager has a critical authentication bypass (CVSS 9.8) that lets an unauthenticated remote attacker gain admin-level API access. Cisco reports active exploitation in the wild. Update to a fixed release.", "url": "https://bsky.app/profile/suriq.io/post/3mwqgjzyjqi2r"}, {"timestamp": "2026-09-30T13:24:54Z", "date_only": false, "value": "2026-09-30T13:24:54.000000Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/09/cisco-warns-of-attackers-exploiting.html", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "3d81414e-19fc-464e-8789-a7ca6e872076", "content": "Attackers are exploiting a new critical zero-day flaw in Cisco Catalyst SD-WAN Manager, the system companies use to manage their Cisco SD-WAN networks, Cisco said in an advisory on September 30.\n\nThe flaw, CVE-2026-76504, could allow a remote attacker with no login access to use the Manager's API as the admin user. Fixed releases are available, and there is no workaround. It carries a", "url": "https://thehackernews.com/2026/09/cisco-warns-of-attackers-exploiting.html"}, {"timestamp": "2026-09-30T13:49:09Z", "date_only": false, "value": "2026-09-30T13:49:09+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-76504", "field": "timestamps.asserted_at", "uuid": "d5233a23-4682-413c-818a-709221feb653", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-30T13:49:09Z", "date_only": false, "value": "2026-09-30T13:49:09+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-76504", "field": "timestamps.first_seen_at", "uuid": "d5233a23-4682-413c-818a-709221feb653", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-30T13:49:09Z", "date_only": false, "value": "2026-09-30T13:49:09+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-76504", "field": "status.status_updated_at", "uuid": "d5233a23-4682-413c-818a-709221feb653", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-30T13:49:09.169Z", "date_only": false, "value": "2026-09-30T13:49:09.169Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-76504", "field": "evidence.0.details.added_date", "uuid": "d5233a23-4682-413c-818a-709221feb653", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-30T14:07:53.121Z", "date_only": false, "value": "2026-09-30T14:07:53.121459Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwqjdik2gp2f", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "ebb772f0-1b15-4f08-bae4-51504d2227b9", "content": "\ud83d\udea8 CVE-2026-76504 \u2014 CVSS 9.8 CRITICAL\n\nA vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could a...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-76504\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mwqjdik2gp2f"}, {"timestamp": "2026-09-30T14:43:36.844Z", "date_only": false, "value": "2026-09-30T14:43:36.844848Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0395", "record": "NCSC-2026-0395", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-09-30T14:43:36.844Z", "date_only": false, "value": "2026-09-30T14:43:36.844848Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0395", "record": "NCSC-2026-0395", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-09-30T14:43:36.844Z", "date_only": false, "value": "2026-09-30T14:43:36.844848Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0395", "record": "NCSC-2026-0395", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-09-30T14:47:02.917Z", "date_only": false, "value": "2026-09-30T14:47:02.917970Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bleepingcomputer.com/post/3mwqljkejjl2r", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "b90f2fcf-5c53-44c0-8120-69138b5971b3", "content": "Cisco\u00a0released security updates to address a critical zero-day in the Catalyst SD-WAN Manager (tracked as\u00a0CVE-2026-76504) that attackers are actively exploiting to\u00a0escalate to admin privileges.", "url": "https://bsky.app/profile/bleepingcomputer.com/post/3mwqljkejjl2r"}, {"timestamp": "2026-09-30T15:16:17.041Z", "date_only": false, "value": "2026-09-30T15:16:17.041367Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwqn5w3rwy2x", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "151e909e-2d01-4523-bb9f-47423b54d1a8", "content": "Attackers exploit CVE-2026-76504, a 9.8 authentication bypass in Cisco SD-WAN Manager that grants admin API access. Patch now.\n\n#Cisco #SDWAN #CVE202676504 #AuthenticationBypass #ActivelyExploited #CyberSecurity", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mwqn5w3rwy2x"}, {"timestamp": "2026-09-30T15:17:54Z", "date_only": false, "value": "2026-09-30T15:17:54.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/BleepingComputer/25693", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "8dd1b94b-80db-4b44-9cc5-9b88cd3392d9", "content": "\u200aCisco warns of new SD-WAN zero-day exploited in attacks\n\nCisco\u00a0released security updates to address a critical zero-day in the Catalyst SD-WAN Manager (tracked as\u00a0CVE-2026-76504) that attackers are actively exploiting to\u00a0escalate to admin privileges. [...]\n\nhttps://www.bleepingcomputer.com/news/security/cisco-warns-of-new-sd-wan-authentication-bypass-zero-day-exploited-in-attacks/", "url": "https://t.me/BleepingComputer/25693"}, {"timestamp": "2026-09-30T15:17:54Z", "date_only": false, "value": "2026-09-30T15:17:54.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/BleepingComputer/25693", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "d3e2d7a0-ad67-4b5e-af48-21d4c27caa93", "content": "\u200aCisco warns of new SD-WAN zero-day exploited in attacks\n\nCisco\u00a0released security updates to address a critical zero-day in the Catalyst SD-WAN Manager (tracked as\u00a0CVE-2026-76504) that attackers are actively exploiting to\u00a0escalate to admin privileges. [...]\n\nhttps://www.bleepingcomputer.com/news/security/cisco-warns-of-new-sd-wan-authentication-bypass-zero-day-exploited-in-attacks/", "url": "https://t.me/BleepingComputer/25693"}, {"timestamp": "2026-09-30T15:28:09Z", "date_only": false, "value": "2026-09-30T15:28:09.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/10205", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "e701d22c-7770-435b-a046-526791e03918", "content": "\u203c\ufe0f WARNING - Cisco says attackers are exploiting a critical SD-WAN Manager authentication bypass.\n\nCVE-2026-76504 lets a remote attacker access the Manager API as admin without credentials. Cisco has fixes, no workaround, and log checks for suspicious activity.\n\nRead: https://thehackernews.com/2026/09/cisco-warns-of-attackers-exploiting.html", "url": "https://t.me/thehackernews/10205"}, {"timestamp": "2026-09-30T15:28:09Z", "date_only": false, "value": "2026-09-30T15:28:09.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/thehackernews/10205", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "84a7afb8-0e02-45b7-b3eb-7c6bcd7d4aa7", "content": "\u203c\ufe0f WARNING - Cisco says attackers are exploiting a critical SD-WAN Manager authentication bypass.\n\nCVE-2026-76504 lets a remote attacker access the Manager API as admin without credentials. Cisco has fixes, no workaround, and log checks for suspicious activity.\n\nRead: https://thehackernews.com/2026/09/cisco-warns-of-attackers-exploiting.html", "url": "https://t.me/thehackernews/10205"}, {"timestamp": "2026-09-30T15:31:25Z", "date_only": false, "value": "2026-09-30T15:31:25Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-XQJC-V467-8FVF", "record": "GHSA-XQJC-V467-8FVF", "field": "published"}, {"timestamp": "2026-09-30T15:41:21.871Z", "date_only": false, "value": "2026-09-30T15:41:21.871201Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ikehjames25.bsky.social/post/3mwqokrbcvk2p", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "d70303c4-7c01-456a-a45d-05718dcc4b37", "content": "Cisco SD-WAN Manager Critical Flaw Actively Exploited (CVE-2026-76504)\n\nCisco has issued a critical warning regarding active exploitation of an authentication bypass vulnerability, CVE-2026-76504, in its Catalyst SD-WAN Manager. The flaw allows unauthenticated remote attackers to gain\u2026", "url": "https://bsky.app/profile/ikehjames25.bsky.social/post/3mwqokrbcvk2p"}, {"timestamp": "2026-09-30T15:44:01.484Z", "date_only": false, "value": "2026-09-30T15:44:01.484985Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mwqopgwl272c", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "a36bb19d-e9dc-4055-a824-0b39b94dfd75", "content": "CVE-2026-76504 lets unauthenticated attackers use Cisco Catalyst SD-WAN Manager\u2019s API as admin via crafted URI encoding, requiring upgrades with no workaround.\n", "url": "https://bsky.app/profile/privpros.bsky.social/post/3mwqopgwl272c"}, {"timestamp": "2026-09-30T15:44:45.171Z", "date_only": false, "value": "2026-09-30T15:44:45.171443Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwqoqsh26z2k", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "61fb4c3e-2afa-4620-b793-2f7c16b6198c", "content": "CVE-2026-76504 lets unauthenticated attackers use Cisco Catalyst SD-WAN Manager\u2019s API as admin via crafted URI encoding, requiring upgrades with no workaround.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwqoqsh26z2k"}, {"timestamp": "2026-09-30T15:45:34.011Z", "date_only": false, "value": "2026-09-30T15:45:34.011266Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mwqos4zvwi24", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "34e9b51c-5fd3-4bb8-93e9-09ed68031ce8", "content": "CVE-2026-76504 lets unauthenticated attackers use Cisco Catalyst SD-WAN Manager\u2019s API as admin via crafted URI encoding, requiring upgrades with no workaround.\n", "url": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mwqos4zvwi24"}, {"timestamp": "2026-09-30T16:06:47Z", "date_only": false, "value": "2026-09-30T16:06:47.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/ichintu/b130d435953d44b507385ebed252960e", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "1c88bbd8-9c30-4d51-9a8a-1b220dc9293e", "content": "On September 30, 2026, cybersecurity advisories highlighted a surge of critical vulnerabilities across enterprise infrastructure, web platforms, and AI ecosystems. Key disclosures include an actively exploited authentication bypass in Cisco\u2019s Catalyst SD-WAN Manager (CVE-2026-76504), numerous critical flaws in WordPress plugins (SQL injection, RCE, and privilege escalation), and high-severity issues in MISP, Citrix NetScaler (compromising Dutch government systems), OpenSSL, and TeamViewer. The digest also flagged emerging AI supply-chain risks, including ChatGPT Custom GPT abuse for malware delivery and an arbitrary code execution flaw in Unsloth\u2019s model picker. Across all alerts, the urgent recommendation is immediate patching, strict configuration enforcement, and heightened monitoring of browser-based and trust-exploitation attack vectors.", "url": "https://gist.github.com/ichintu/b130d435953d44b507385ebed252960e"}, {"timestamp": "2026-09-30T16:06:54.761Z", "date_only": false, "value": "2026-09-30T16:06:54.761330Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/entorisec.bsky.social/post/3mwqpy5chpu22", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "5e57bf00-6c78-43d7-8e53-3b62294f0d76", "content": "Cisco confirms active exploitation of CVE-2026-76504, a CVSS 9.8 auth bypass in Catalyst SD-WAN Manager. A URI-encoding trick bypasses the admin API login check, no credentials needed. It's the fifth SD-WAN zero-day exploited this year. Patches are out, no workaround. bleepingcomputer.com/new...", "url": "https://bsky.app/profile/entorisec.bsky.social/post/3mwqpy5chpu22"}, {"timestamp": "2026-09-30T16:09:43.781Z", "date_only": false, "value": "2026-09-30T16:09:43.781903Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/AAKL/statuses/117360858430598633", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "2ab84006-ce06-45d6-ac98-b6854b1761b8", "content": "New advisory, new flaw.\nCisco: CRITICAL CVE-2026-76504: Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU @TalosSecurity #Cisco  \nAlso:\nBroadcom has several advisories today, three of them addressing critical vulnerabilities https://support.broadcom.com/web/ecx/security-advisory #Broadcom #infosec #vulnerability", "url": "https://infosec.exchange/users/AAKL/statuses/117360858430598633"}, {"timestamp": "2026-09-30T16:35:39.162Z", "date_only": false, "value": "2026-09-30T16:35:39.162942Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwqrlphapx22", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "85af0d96-2538-48fb-9e6a-bb20d4b16807", "content": "\ud83e\udd16 CVE-2026-76504 (CVSS 9.8): pre-auth auth bypass in Cisco Catalyst SD-WAN Manager. URI-encoding flaw in the login-session API lets unauthenticated attackers call the API as admin. Actively exploited, no workaround.\nhttps://thehackernews.com/2026/09/cisco-warns-of-attackers-exploiting.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mwqrlphapx22"}, {"timestamp": "2026-09-30T16:45:28.959Z", "date_only": false, "value": "2026-09-30T16:45:28.959083Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwqs5gtqdv22", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "1eb94266-e9f6-47bb-9e8f-4e48f4a5e386", "content": "Cisco patched CVE-2026-76504, a critical zero-day in Catalyst SD-WAN Manager actively exploited to gain admin access via crafted HTTP requests and auth bypass. #Cisco #SDWAN #ZeroDay", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwqs5gtqdv22"}, {"timestamp": "2026-09-30T17:42:38.151Z", "date_only": false, "value": "2026-09-30T17:42:38.151536Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mwqvdmwjkp2o", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "50a3b0e3-9a50-4a48-afd5-e0c84d6b3746", "content": "\ud83d\uded1 CVE-2026-76504\nCisco Catalyst SD-WAN Manager\nCVSS 9.8 / KEV: No\nTL;DR: A vulnerability in the API session-based authentication management of Cisco Catalyst SD\u2026\nhttps://cvesentinel.com/report/CVE-2026-76504?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mwqvdmwjkp2o"}, {"timestamp": "2026-09-30T17:44:45Z", "date_only": false, "value": "2026-09-30T17:44:45.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/zpVK_evOMfTjGViaq7O0fPrN-cyP4Due_vpD-D7lUZJ5ZxI", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "e33df2c8-510d-4bc1-bc69-fa17e69bca33"}, {"timestamp": "2026-09-30T17:44:45Z", "date_only": false, "value": "2026-09-30T17:44:45.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/zpVK_evOMfTjGViaq7O0fPrN-cyP4Due_vpD-D7lUZJ5ZxI", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "0949b005-effb-42ad-ace8-8c4ee447832d"}, {"timestamp": "2026-09-30T18:00:01Z", "date_only": false, "value": "2026-09-30T18:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-76504", "field": "timestamps.recorded_at", "uuid": "f5bc2a87-dc34-47c6-ac53-71cf2a28f1ac", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-30T18:00:01.897Z", "date_only": false, "value": "2026-09-30T18:00:01.897425Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f5bc2a87-dc34-47c6-ac53-71cf2a28f1ac", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "c21ebc43-083e-48b2-a7f0-22c2e6c24424", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f5bc2a87-dc34-47c6-ac53-71cf2a28f1ac"}, {"timestamp": "2026-09-30T18:01:54.728Z", "date_only": false, "value": "2026-09-30T18:01:54.728494Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mwqwg3gmt42s", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "c2687b36-cc98-4ffd-97e1-bac07eed120c", "content": "Cisco Catalyst SD-WAN Manager\u306b\u3001\u7ba1\u7406\u8005\u6a29\u9650\u6607\u683c\u3092\u53ef\u80fd\u306b\u3059\u308b\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\uff08CVE-2026-76504\uff09\u304c\u767a\u898b\u3055\u308c\u3001\u653b\u6483\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mwqwg3gmt42s"}, {"timestamp": "2026-09-30T18:20:04.684Z", "date_only": false, "value": "2026-09-30T18:20:04.684600Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aipostdaily.bsky.social/post/3mwqxgkktnf2m", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "1261d854-019c-4eb2-83fd-17e4f633ee60", "content": "CISA added CVE-2026-76504 to its Known Exploited Vulnerabilities list (2026-09-30).\nCisco Catalyst SD-WAN Manager Hex Encoding\n#infosec #KEV", "url": "https://bsky.app/profile/aipostdaily.bsky.social/post/3mwqxgkktnf2m"}, {"timestamp": "2026-09-30T18:30:47.372Z", "date_only": false, "value": "2026-09-30T18:30:47.372710Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/115741367687413652/statuses/117361406235281992", "record": "cve-2026-76504", "field": "creation_timestamp", "uuid": "1e392117-80ac-45fe-97c4-67cf51f499f0", "content": "Well would you look at that; it's Cisco 0-day o'clock again.\nhttps://ifin.network/t/cve-2026-76504-cisco-sd-wan-auth-bypass-actively-exploited/874\n#ThreatIntel #ThreatIntelligence #IFIN", "url": "https://infosec.exchange/ap/users/115741367687413652/statuses/117361406235281992"}, {"timestamp": "2026-09-30T18:33:25Z", "date_only": false, "value": "2026-09-30T18:33:25Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-XQJC-V467-8FVF", "record": "GHSA-XQJC-V467-8FVF", "field": "modified"}, {"timestamp": "2026-09-30T18:34:32.611Z", "date_only": false, "value": "2026-09-30T18:34:32.611098Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117361427861570548", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "2c14cf7f-9cd6-4a46-b877-f4df07606e73", "content": "\ud83d\udea8 Cisco warns critical SD-WAN Manager zero-day is actively exploited\nCVE-2026-76504 is a critical authentication bypass affecting Cisco Catalyst SD-WAN Manager.\nThe flaw allows an unauthenticated remote attacker to send a crafted HTTP request that bypasses an API authentication rule and grants access with admin privileges.\u2800The vulnerability carries a CVSS score of 9.8 and affects the product regardless of its configuration.\nCisco became aware of active exploitation in September after investigating a support case.\u2800There are no workarounds. Administrators should install a fixed release immediately and investigate internet-facing systems for signs of compromise.\nSource: https://www.bleepingcomputer.com/news/security/cisco-warns-of-new-sd-wan-authentication-bypass-zero-day-exploited-in-attacks/", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/117361427861570548"}, {"timestamp": "2026-09-30T18:37:44Z", "date_only": false, "value": "2026-09-30T18:37:44.000009Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/planetbriefing.bsky.social/post/3mwqyg425pv23", "record": "cve-2026-76504", "field": "creation_timestamp", "uuid": "df8f976c-597c-4dce-95ed-c1e1eb85f563", "content": "CVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability\n\nCisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that cou\u2026\n\nhttps://planetbriefing.com/events/cve-2026-76504-cisco-catalyst-sd-wan-manager-hex-encoding-vulnerability-e748ceab6714\n\n#Technology #UnitedStates", "url": "https://bsky.app/profile/planetbriefing.bsky.social/post/3mwqyg425pv23"}, {"timestamp": "2026-09-30T19:00:16.004Z", "date_only": false, "value": "2026-09-30T19:00:16.004690Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/secdb.bsky.social/post/3mwqzoffbv52y", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "a6d80764-50df-403b-b9cd-a3c958537d58", "content": "\ud83d\udea8 CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0930)\n\n\u26a0\ufe0f CVE-2026-76504 - Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability\n\n\n#ZEN #SecDB #InfoSec #CISA_KEV", "url": "https://bsky.app/profile/secdb.bsky.social/post/3mwqzoffbv52y"}, {"timestamp": "2026-09-30T20:27:22Z", "date_only": false, "value": "2026-09-30T20:27:22.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/QJKQmPuS5zYom2ifjgMvhPgK9FpZu6IwhwSxkEodRO5v-w", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "48cec902-0092-494c-9f35-c78144758176"}, {"timestamp": "2026-09-30T20:31:42.134Z", "date_only": false, "value": "2026-09-30T20:31:42.134907Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwr6rwfqjz2r", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "72c85696-42c5-4623-b510-90040630fa64", "content": "Cisco warns of active exploitation of CVE-2026-76504 in Catalyst SD-WAN Manager, a critical auth bypass that lets remote unauthenticated attackers access the API as admin. 3 hashtags: #Cisco #SDWAN #CVE202676504", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwr6rwfqjz2r"}, {"timestamp": "2026-09-30T23:00:22Z", "date_only": false, "value": "2026-09-30T23:00:22.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/p8fCe73qPhNi0gtkgFiWePACon_RGM1KmaCzYKDKoMfuYzQ", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "eaf0e773-adfe-4a1a-b33c-bc8b23f7bae0"}, {"timestamp": "2026-09-30T23:00:22Z", "date_only": false, "value": "2026-09-30T23:00:22.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/p8fCe73qPhNi0gtkgFiWePACon_RGM1KmaCzYKDKoMfuYzQ", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "bdf578cc-07e9-4d52-96f6-95038299b3c7"}, {"timestamp": "2026-09-30T23:00:38Z", "date_only": false, "value": "2026-09-30T23:00:38.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/44684", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "5bbbbc8a-cf12-4b37-afb0-21f53537c66a", "content": "Cisco warns of new SD-WAN zero-day exploited in attacks\n\nCisco\u00a0released security updates to address a critical zero-day in the Catalyst SD-WAN Manager (tracked as\u00a0CVE-2026-76504) that attackers are actively exploiting to\u00a0escalate to admin privileges. [...]\nhttps://www.bleepingcomputer.com/news/security/cisco-warns-of-new-sd-wan-authentication-bypass-zero-day-exploited-in-attacks/", "url": "https://t.me/VulnerabilityNews/44684"}, {"timestamp": "2026-10-01T00:00:00Z", "date_only": false, "value": "2026-10-01T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1246", "record": "CERTFR-2026-AVI-1246", "field": "last_revision_date"}, {"timestamp": "2026-10-01T00:00:00Z", "date_only": false, "value": "2026-10-01T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1246", "record": "CERTFR-2026-AVI-1246", "field": "initial_release_date"}, {"timestamp": "2026-10-01T00:00:00Z", "date_only": false, "value": "2026-10-01T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1246", "record": "CERTFR-2026-AVI-1246", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-01T00:29:19.874Z", "date_only": false, "value": "2026-10-01T00:29:19.874879Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alien-rick.bsky.social/post/3mwrm2sb55c2s", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "7943fd73-59d8-45da-89b0-9d5e547973a7", "content": "Science tip. Cisco SD-WAN Manager treats /%6a_security_check like a VIP badge. CVE-2026-76504, CVSS 9.8, unauth admin API, already wild. CISA wants federal boxes patched by Oct 3. Morty, your WAN is now a polite suggestion. day274.009", "url": "https://bsky.app/profile/alien-rick.bsky.social/post/3mwrm2sb55c2s"}, {"timestamp": "2026-10-01T00:41:57.729Z", "date_only": false, "value": "2026-10-01T00:41:57.729170Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwrmrh57nj2r", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "deaf2dcb-4802-4ede-b110-4fe0e36037bf", "content": "\ud83e\udd16 CVE-2026-76504: critical auth bypass in Cisco Catalyst SD-WAN Manager. Unauthenticated attacker can call the Manager API as admin. Actively exploited, no workaround.\nhttps://thehackernews.com/2026/09/cisco-warns-of-attackers-exploiting.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mwrmrh57nj2r"}, {"timestamp": "2026-10-01T01:31:14.251Z", "date_only": false, "value": "2026-10-01T01:31:14.251022Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alien-rick.bsky.social/post/3mwrpjiezxc2q", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "1851e95f-f083-4f28-8343-ce3611334f2a", "content": "Science tip. Cisco SD-WAN Manager treats /%6a_security_check like a VIP badge. CVE-2026-76504, CVSS 9.8, unauth admin API, already wild. CISA wants federal boxes patched by Oct 3. Morty, your WAN is now a polite suggestion. day274.009", "url": "https://bsky.app/profile/alien-rick.bsky.social/post/3mwrpjiezxc2q"}, {"timestamp": "2026-10-01T02:07:07.132Z", "date_only": false, "value": "2026-10-01T02:07:07.132867Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwrrjpfqlk2s", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "cd099e1f-d385-447d-8ce2-09f6e3192368", "content": "\ud83d\udccc CVE-2026-76504 - A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to... https://www.cyberhub.blog/cves/CVE-2026-76504", "url": "https://bsky.app/profile/cyberhub.blog/post/3mwrrjpfqlk2s"}, {"timestamp": "2026-10-01T02:14:23.523Z", "date_only": false, "value": "2026-10-01T02:14:23.523128Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/judgement-bot.bsky.social/post/3mwrrwqajxz2s", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "508f7fb9-df30-47ec-bd3a-2ef04b5bd7de", "content": "Cisco disclosed a severe CVSS 9.8 authentication bypass vulnerability (CVE-2026-76504) in its Catalyst SD-WAN Manager, prompting emergency patching across all release trains.", "url": "https://bsky.app/profile/judgement-bot.bsky.social/post/3mwrrwqajxz2s"}, {"timestamp": "2026-10-01T02:36:09.965Z", "date_only": false, "value": "2026-10-01T02:36:09.965079Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwrt5nxdui2n", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "6dc30ce1-d114-4dd7-bb59-98773a7652ba", "content": "CISA\u304c\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\u30921\u4ef6\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0 #CISA (Sep 30)\n\nCVE-2026-76504 Cisco Catalyst SD-WAN Manager\u306e16\u9032\u6570\u30a8\u30f3\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\u306e\u8106\u5f31\u6027 \n\nwww.cisa.gov/news-events/...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mwrt5nxdui2n"}, {"timestamp": "2026-10-01T02:42:03.657Z", "date_only": false, "value": "2026-10-01T02:42:03.657236Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwrti77u5j2o", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "f4831adc-2d2f-47ce-b21d-188f8685dcc3", "content": "Cisco SD-WAN Manager CVE-2026-76504: Critical Auth Bypass Exploited in the Wild\uff08Cisco SD-WAN Manager\u306e\u91cd\u5927\u306a\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u8106\u5f31\u6027CVE-2026-76504\u304c\u5b9f\u60aa\u7528\uff09 #SecurityOnline (Sep 30)\nsecurityonline.info/cisco-sd-wan...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mwrti77u5j2o"}, {"timestamp": "2026-10-01T03:00:06Z", "date_only": false, "value": "2026-10-01T03:00:06.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/FJhHNxuddf7TpLw0kSRARdOIBivVItQHKCcKtq2qfHsVogM", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "0d59f85d-4330-430c-a589-f1fca8f55d23"}, {"timestamp": "2026-10-01T03:55:35.195Z", "date_only": false, "value": "2026-10-01T03:55:35.195Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-76504", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-01T04:01:01.384Z", "date_only": false, "value": "2026-10-01T04:01:01.384570Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwrxvfnfzu2j", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "1ddfe54b-dd7b-461c-9537-343e143ba901", "content": "~Cisa~\nCISA reports active exploitation of a Cisco Catalyst SD-WAN Manager hex encoding vulnerability; prioritize remediation.\n-\nIOCs: CVE-2026-76504\n-\n#CVE202676504 #Cisco #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mwrxvfnfzu2j"}, {"timestamp": "2026-10-01T04:09:59Z", "date_only": false, "value": "2026-10-01T04:09:59.000000Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-978", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "d80dddf1-cd4f-48bb-8e7b-278983177f39", "url": "https://cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-978"}, {"timestamp": "2026-10-01T04:51:35Z", "date_only": false, "value": "2026-10-01T04:51:35.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/CyberDispatch/3170", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "7c744a5d-b2fc-4094-8c58-1a16a722302e", "content": "Cisco says attackers are exploiting a critical SD-WAN Manager authentication bypass.\n\nCVE-2026-76504 lets a remote attacker access the Manager API as admin without credentials. Cisco has fixes, no workaround, and log checks for suspicious activity.", "url": "https://t.me/CyberDispatch/3170"}, {"timestamp": "2026-10-01T04:51:35Z", "date_only": false, "value": "2026-10-01T04:51:35.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberDispatch/3170", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "2b7d7077-1da6-47e4-9a52-227eff2e3156", "content": "Cisco says attackers are exploiting a critical SD-WAN Manager authentication bypass.\n\nCVE-2026-76504 lets a remote attacker access the Manager API as admin without credentials. Cisco has fixes, no workaround, and log checks for suspicious activity.", "url": "https://t.me/CyberDispatch/3170"}, {"timestamp": "2026-10-01T06:47:51.562Z", "date_only": false, "value": "2026-10-01T06:47:51.562903Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mwsb7pxdh72f", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "ed0f1288-04ba-4285-aae1-799edc4a0e44", "content": "CISA added CVE-2026-76504 to its Known Exploited Vulnerabilities list yesterday. If you're running Cisco Catalyst SD-WAN Managers, you've got a problem.\n\n#ransomware #vulnerability #infosec", "url": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mwsb7pxdh72f"}, {"timestamp": "2026-10-01T07:19:17Z", "date_only": false, "value": "2026-10-01T07:19:17.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/cyberbannews_ir/23821", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "5c27e8e4-1e8b-4381-9e50-55c1d3e11457", "content": "\u2666\ufe0f \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062c\u062f\u06cc\u062f \u062f\u0631 \u0633\u0627\u0645\u0627\u0646\u0647 \u0645\u062f\u06cc\u0631\u06cc\u062a SD-WAN \u0633\u06cc\u0633\u06a9\u0648 \u06a9\u0634\u0641 \u0634\u062f\n\n\ud83d\udd3a \u0633\u06cc\u0633\u06a9\u0648 \u0627\u0632 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-2026-76504 \u062f\u0631 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0634\u0628\u06a9\u0647 Catalyst SD-WAN Manager \u062e\u0628\u0631 \u062f\u0627\u062f\u061b \u0646\u0642\u0635\u06cc \u06a9\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u062f\u0631 \u062d\u0645\u0644\u0627\u062a \u0648\u0627\u0642\u0639\u06cc \u0627\u0632 \u0622\u0646 \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f.\n\n\ud83d\udd3b \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0646\u0627\u0645 \u06a9\u0627\u0631\u0628\u0631\u06cc \u0648 \u0631\u0645\u0632 \u0639\u0628\u0648\u0631 \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0648\u0627\u0631\u062f \u0633\u0627\u0645\u0627\u0646\u0647 \u0634\u0648\u062f \u0648 \u062f\u0633\u062a\u0631\u0633\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc \u0628\u0647 \u062f\u0633\u062a \u0622\u0648\u0631\u062f.\n\n\ud83d\udd39 \u0633\u06cc\u0633\u06a9\u0648 \u0628\u0631\u0627\u06cc \u0631\u0641\u0639 \u0627\u06cc\u0646 \u0645\u0634\u06a9\u0644\u060c \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u0631\u0627 \u0645\u0646\u062a\u0634\u0631 \u06a9\u0631\u062f\u0647 \u0648 \u0627\u0632 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u062e\u0648\u0627\u0633\u062a\u0647 \u0647\u0631\u0686\u0647 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u062e\u0648\u062f \u0631\u0627 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u06a9\u0646\u0646\u062f.\n\n\ud83d\udd39 \u0622\u0698\u0627\u0646\u0633 \u0627\u0645\u0646\u06cc\u062a \u0633\u0627\u06cc\u0628\u0631\u06cc \u0622\u0645\u0631\u06cc\u06a9\u0627 \u0646\u06cc\u0632 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0627 \u062f\u0631 \u0641\u0647\u0631\u0633\u062a \u0646\u0642\u0635\u200c\u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0641\u0639\u0627\u0644 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0647 \u0648 \u0627\u0632 \u0633\u0627\u0632\u0645\u0627\u0646\u200c\u0647\u0627\u06cc \u062f\u0648\u0644\u062a\u06cc \u062e\u0648\u0627\u0633\u062a\u0647 \u062a\u0627 \u06f3 \u0627\u06a9\u062a\u0628\u0631 \u0628\u0631\u0627\u06cc \u0631\u0641\u0639 \u0622\u0646 \u0627\u0642\u062f\u0627\u0645 \u06a9\u0646\u0646\u062f.\n\n#\u0627\u0645\u0646\u06cc\u062a_\u0633\u0627\u06cc\u0628\u0631\u06cc #\u0633\u06cc\u0633\u06a9\u0648 #\u0622\u0633\u06cc\u0628_\u067e\u0630\u06cc\u0631\u06cc\n\n\ud83d\udcc4\ud83d\udd0d @cyberbannews_ir", "url": "https://t.me/cyberbannews_ir/23821"}, {"timestamp": "2026-10-01T07:19:17Z", "date_only": false, "value": "2026-10-01T07:19:17.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberbannews_ir/23821", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "47ab69cd-1308-48c7-8c1e-99dfe15ff2a8", "content": "\u2666\ufe0f \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062c\u062f\u06cc\u062f \u062f\u0631 \u0633\u0627\u0645\u0627\u0646\u0647 \u0645\u062f\u06cc\u0631\u06cc\u062a SD-WAN \u0633\u06cc\u0633\u06a9\u0648 \u06a9\u0634\u0641 \u0634\u062f\n\n\ud83d\udd3a \u0633\u06cc\u0633\u06a9\u0648 \u0627\u0632 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-2026-76504 \u062f\u0631 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0634\u0628\u06a9\u0647 Catalyst SD-WAN Manager \u062e\u0628\u0631 \u062f\u0627\u062f\u061b \u0646\u0642\u0635\u06cc \u06a9\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u062f\u0631 \u062d\u0645\u0644\u0627\u062a \u0648\u0627\u0642\u0639\u06cc \u0627\u0632 \u0622\u0646 \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f.\n\n\ud83d\udd3b \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0646\u0627\u0645 \u06a9\u0627\u0631\u0628\u0631\u06cc \u0648 \u0631\u0645\u0632 \u0639\u0628\u0648\u0631 \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0648\u0627\u0631\u062f \u0633\u0627\u0645\u0627\u0646\u0647 \u0634\u0648\u062f \u0648 \u062f\u0633\u062a\u0631\u0633\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc \u0628\u0647 \u062f\u0633\u062a \u0622\u0648\u0631\u062f.\n\n\ud83d\udd39 \u0633\u06cc\u0633\u06a9\u0648 \u0628\u0631\u0627\u06cc \u0631\u0641\u0639 \u0627\u06cc\u0646 \u0645\u0634\u06a9\u0644\u060c \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631 \u0631\u0627 \u0645\u0646\u062a\u0634\u0631 \u06a9\u0631\u062f\u0647 \u0648 \u0627\u0632 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u062e\u0648\u0627\u0633\u062a\u0647 \u0647\u0631\u0686\u0647 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u062e\u0648\u062f \u0631\u0627 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u06a9\u0646\u0646\u062f.\n\n\ud83d\udd39 \u0622\u0698\u0627\u0646\u0633 \u0627\u0645\u0646\u06cc\u062a \u0633\u0627\u06cc\u0628\u0631\u06cc \u0622\u0645\u0631\u06cc\u06a9\u0627 \u0646\u06cc\u0632 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0627 \u062f\u0631 \u0641\u0647\u0631\u0633\u062a \u0646\u0642\u0635\u200c\u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0641\u0639\u0627\u0644 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0647 \u0648 \u0627\u0632 \u0633\u0627\u0632\u0645\u0627\u0646\u200c\u0647\u0627\u06cc \u062f\u0648\u0644\u062a\u06cc \u062e\u0648\u0627\u0633\u062a\u0647 \u062a\u0627 \u06f3 \u0627\u06a9\u062a\u0628\u0631 \u0628\u0631\u0627\u06cc \u0631\u0641\u0639 \u0622\u0646 \u0627\u0642\u062f\u0627\u0645 \u06a9\u0646\u0646\u062f.\n\n#\u0627\u0645\u0646\u06cc\u062a_\u0633\u0627\u06cc\u0628\u0631\u06cc #\u0633\u06cc\u0633\u06a9\u0648 #\u0622\u0633\u06cc\u0628_\u067e\u0630\u06cc\u0631\u06cc\n\n\ud83d\udcc4\ud83d\udd0d @cyberbannews_ir", "url": "https://t.me/cyberbannews_ir/23821"}, {"timestamp": "2026-10-01T08:01:19.886Z", "date_only": false, "value": "2026-10-01T08:01:19.886546Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwsfd2xupm2r", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "cbd95b25-b16e-4843-9ff1-065eeaf12b3a", "content": "Cisco waarschuwt voor kritieke kwetsbaarheid in SD-WAN Manager die actief wordt \n\nCisco heeft op 30 september 2026 een advies uitgebracht over een kritieke kwetsbaarheid, geregistreerd als CVE-2026-76504, in Cisco Catalyst SD-WAN Manager. Deze kwetsbaarheid wordt momenteel actief uitgebuit d...", "url": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwsfd2xupm2r"}, {"timestamp": "2026-10-01T08:30:04.404Z", "date_only": false, "value": "2026-10-01T08:30:04.404808Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mwsgwi5ok325", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "05eb4178-dacc-4e13-bcbd-10d6a16dd555", "content": "\u30b7\u30b9\u30b3\u3001\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305fCatalyst SD-WAN\u306e\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u306b\u30d1\u30c3\u30c1\u3092\u516c\u958b\n\n\u30b7\u30b9\u30b3\u306f\u6c34\u66dc\u65e5\u3001Catalyst SD-WAN Manager\u306b\u5b58\u5728\u3057\u3001\u5b9f\u969b\u306e\u653b\u6483\u3067\u306e\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u3066\u3044\u308b\u91cd\u5927\u306a\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u306e\u8106\u5f31\u6027\u306b\u5bfe\u51e6\u3059\u308b\u7dca\u6025\u30d1\u30c3\u30c1\u3092\u516c\u958b\u3057\u307e\u3057\u305f\u3002 \u3053\u306e\u8106\u5f31\u6027\u306f\u300cCVE-2026-76504\u300d\uff08CVSS\u30b9\u30b3\u30a29.8\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u3044\u307e\u3059\u3002API\u306e\u30bb\u30c3\u30b7\u30e7\u30f3\u30d9\u30fc\u30b9\u8a8d\u8a3c\u30e1\u30ab\u30cb\u30ba\u30e0\u306b\u5f71\u97ff\u3057\u3001\u30ea\u30e2\u30fc\u30c8", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mwsgwi5ok325"}, {"timestamp": "2026-10-01T08:31:12.101Z", "date_only": false, "value": "2026-10-01T08:31:12.101701Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ikehjames25.bsky.social/post/3mwsgygnuih2b", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "da7c3c19-6eb0-4ca7-891f-3a6245597a06", "content": "Cisco Patches Critical Catalyst SD-WAN Zero-Day Under Active\u00a0Exploitation\n\nCisco has issued urgent patches for a critical zero-day vulnerability (CVE-2026-76504) in its Catalyst SD-WAN Manager. The flaw, which allows remote, unauthenticated administrative access, is confirmed to be under active\u2026", "url": "https://bsky.app/profile/ikehjames25.bsky.social/post/3mwsgygnuih2b"}, {"timestamp": "2026-10-01T08:45:19.693Z", "date_only": false, "value": "2026-10-01T08:45:19.693215Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mwshrqyhv526", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "f590ac7e-9dac-4778-8b9f-fe6ebd9c408a", "content": "CVE-2026-76504 enables remote unauthenticated attackers to bypass authentication and gain admin access in Catalyst SD-WAN Manager via improper URI encoding.\n", "url": "https://bsky.app/profile/privpros.bsky.social/post/3mwshrqyhv526"}, {"timestamp": "2026-10-01T08:46:28.960Z", "date_only": false, "value": "2026-10-01T08:46:28.960818Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mwshtt73qc2l", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "87860966-4a11-4004-b6c1-274bd9baba59", "content": "CVE-2026-76504 enables remote unauthenticated attackers to bypass authentication and gain admin access in Catalyst SD-WAN Manager via improper URI encoding.\n", "url": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mwshtt73qc2l"}, {"timestamp": "2026-10-01T08:46:48.852Z", "date_only": false, "value": "2026-10-01T08:46:48.852192Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwshugf6yf2c", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "3938900f-ff89-4d35-a47e-81427b4407d2", "content": "CVE-2026-76504 enables remote unauthenticated attackers to bypass authentication and gain admin access in Catalyst SD-WAN Manager via improper URI encoding.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwshugf6yf2c"}, {"timestamp": "2026-10-01T09:08:03.057Z", "date_only": false, "value": "2026-10-01T09:08:03.057247Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mwsj2fzbkg2o", "record": "cve-2026-76504", "field": "creation_timestamp", "uuid": "0b6a20c6-8c11-4cff-a35c-e8ec316718b4", "content": "\ud83d\udcf0 Cisco Peringatkan Zero-Day SD-WAN yang Dieksploitasi untuk Ambil Alih Akses Admin\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/10/01/cisco-sd-wan-zero-day-cve-2026-76504/\n\n#cisa #cisco #ciscoCatalystSd-wan #cve #cybersecurity #exploit #keamananSiber #kev #sd-wan #vmanage #vuln", "url": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mwsj2fzbkg2o"}, {"timestamp": "2026-10-01T09:15:46.450Z", "date_only": false, "value": "2026-10-01T09:15:46.450296Z", "kind": "sighting", "label": "Seen", "source": "https://poliverso.org/objects/0477a01e-f68356c9-b7548f0b25733253", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "1c358da0-6e65-4af3-9f32-b41edc7a2c41", "content": "U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Cisco Catalyst SD-WAN Manager flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Cisco Catalyst SD-WAN Manager flaw, tracked as CVE-2026-76504 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability resides in Cisco Catalyst SD-WAN Manager\u2019s [\u2026]U.S. CISA adds Cisco Catalyst SD-WAN Manager flaw to its Known Exploited Vulnerabilities catalog", "url": "https://poliverso.org/objects/0477a01e-f68356c9-b7548f0b25733253"}, {"timestamp": "2026-10-01T09:15:54.214Z", "date_only": false, "value": "2026-10-01T09:15:54.214188Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3mwsjidqx6m62", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "cad7fab3-75e8-43ee-aaf1-fb501ad4d48c", "content": "U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Cisco Catalyst SD-WAN Manager flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Cisco Catalyst SD-WAN Manager flaw, tracked as CVE-2026-76504 (CVSS score [\u2026]", "url": "https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3mwsjidqx6m62"}, {"timestamp": "2026-10-01T09:46:21Z", "date_only": false, "value": "2026-10-01T09:46:21.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/8666", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "00e55780-126a-4fbe-991e-f30eddda330b", "content": "Cisco \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 0-day \u0432 Catalyst SD-WAN Manager (\u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u043a\u0430\u043a CVE-2026-76504), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0434\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430.\n\n\u0420\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0435 \u043a\u0430\u043a SD-WAN vManage, \u041f\u041e Catalyst SD-WAN Manager \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0434\u043e 6000 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438 SD-WAN \u0441 \u0435\u0434\u0438\u043d\u043e\u0439 \u043f\u0430\u043d\u0435\u043b\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\n\u041a\u0430\u043a \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f, \u0432 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 Cisco PSIRT \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u044d\u0442\u043e\u0439 CVE-2026-76504.\n\n\u041e\u043d\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e \u043e\u0442 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0435\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0441\u0435\u0441\u0441\u0438\u0439 API \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0443\u0441\u043b\u043e\u0432\u043b\u0435\u043d\u0430 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u043a\u0438 URI \u0432 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u0435, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u0443 \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0435 \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0435 API.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441 \u043a API \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0422\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435, Cisco \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0435\u0439 \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c CVE-2026-76504, \u043d\u043e \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0430\u0441\u044c IOCs, \u043e\u0442\u043c\u0435\u0447\u0430\u044f, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 %6a \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 URI \u0441\u0438\u043c\u0432\u043e\u043b\u0430 \"j\" \u0432 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u0430\u0445.\n\n\u0422\u0430\u043a\u0436\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c serviceproxy-access.log, \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u0432 /var/log/nms/containers/service-proxy, \u0438 vmanage-server.log \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 /var/log/nms/ \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0437\u0430\u043f\u0438\u0441\u0435\u0439, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 j_security_check, \u043e\u0442 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0438\u043b\u0438 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 IP.\n\n\u0414\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0442\u043e\u0433\u043e, \u0431\u044b\u043b \u043b\u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d Cisco Catalyst SD-WAN Manager, \u043a\u043b\u0438\u0435\u043d\u0442\u044b \u043c\u043e\u0433\u0443\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c\u0441\u044f \u0432 \u0441\u043b\u0443\u0436\u0431\u0443 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Cisco (TAC) \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438.\n\n\u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, CVE-2026-76504 - \u044d\u0442\u043e \u0443\u0436\u0435 \u043f\u044f\u0442\u0430\u044f 0-day \u0432 SD-WAN, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0441 \u043d\u0430\u0447\u0430\u043b\u0430 \u0433\u043e\u0434\u0430. \u0421\u0435\u0433\u043e\u0434\u043d\u044f CISA \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u043e \u0435\u0435 \u0432 \u0441\u0432\u043e\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 KEV.\n\n\u0412\u043e\u043e\u0431\u0449\u0435 \u0436\u0435 \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2021 \u0433\u043e\u0434\u0430 \u0432 \u0440\u0435\u0435\u0441\u0442\u0440\u0435 CISA 90 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Cisco, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u044b\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0447\u0435\u0442\u044b\u0440\u0435 \u0432 Cisco Catalyst SD-WAN Manager, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0441\u0435\u043c\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0431\u0430\u043d\u0434\u0430\u043c\u0438 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439.", "url": "https://t.me/true_secator/8666"}, {"timestamp": "2026-10-01T09:46:21Z", "date_only": false, "value": "2026-10-01T09:46:21.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/8666", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "1e2e864b-d1e9-44e3-a2c1-b96318f44af5", "content": "Cisco \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 0-day \u0432 Catalyst SD-WAN Manager (\u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u043a\u0430\u043a CVE-2026-76504), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0438\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0434\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430.\n\n\u0420\u0430\u043d\u0435\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0435 \u043a\u0430\u043a SD-WAN vManage, \u041f\u041e Catalyst SD-WAN Manager \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0434\u043e 6000 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438 SD-WAN \u0441 \u0435\u0434\u0438\u043d\u043e\u0439 \u043f\u0430\u043d\u0435\u043b\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\n\u041a\u0430\u043a \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f, \u0432 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 Cisco PSIRT \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u044d\u0442\u043e\u0439 CVE-2026-76504.\n\n\u041e\u043d\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e \u043e\u0442 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0435\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0441\u0435\u0441\u0441\u0438\u0439 API \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0443\u0441\u043b\u043e\u0432\u043b\u0435\u043d\u0430 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u043a\u0438 URI \u0432 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u0435, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u0443 \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0435 \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0435 API.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0432 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441 \u043a API \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u0422\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435, Cisco \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0435\u0439 \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c CVE-2026-76504, \u043d\u043e \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0430\u0441\u044c IOCs, \u043e\u0442\u043c\u0435\u0447\u0430\u044f, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 %6a \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 URI \u0441\u0438\u043c\u0432\u043e\u043b\u0430 \"j\" \u0432 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u0430\u0445.\n\n\u0422\u0430\u043a\u0436\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c serviceproxy-access.log, \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u0432 /var/log/nms/containers/service-proxy, \u0438 vmanage-server.log \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 /var/log/nms/ \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0437\u0430\u043f\u0438\u0441\u0435\u0439, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 j_security_check, \u043e\u0442 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0438\u043b\u0438 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 IP.\n\n\u0414\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0442\u043e\u0433\u043e, \u0431\u044b\u043b \u043b\u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d Cisco Catalyst SD-WAN Manager, \u043a\u043b\u0438\u0435\u043d\u0442\u044b \u043c\u043e\u0433\u0443\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c\u0441\u044f \u0432 \u0441\u043b\u0443\u0436\u0431\u0443 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Cisco (TAC) \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438.\n\n\u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, CVE-2026-76504 - \u044d\u0442\u043e \u0443\u0436\u0435 \u043f\u044f\u0442\u0430\u044f 0-day \u0432 SD-WAN, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0441 \u043d\u0430\u0447\u0430\u043b\u0430 \u0433\u043e\u0434\u0430. \u0421\u0435\u0433\u043e\u0434\u043d\u044f CISA \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u043e \u0435\u0435 \u0432 \u0441\u0432\u043e\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 KEV.\n\n\u0412\u043e\u043e\u0431\u0449\u0435 \u0436\u0435 \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2021 \u0433\u043e\u0434\u0430 \u0432 \u0440\u0435\u0435\u0441\u0442\u0440\u0435 CISA 90 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Cisco, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u044b\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0447\u0435\u0442\u044b\u0440\u0435 \u0432 Cisco Catalyst SD-WAN Manager, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0441\u0435\u043c\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0431\u0430\u043d\u0434\u0430\u043c\u0438 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439.", "url": "https://t.me/true_secator/8666"}, {"timestamp": "2026-10-01T09:48:09.143Z", "date_only": false, "value": "2026-10-01T09:48:09.143427Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mwslc4i5722m", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "7fd8d75b-1e9b-437c-907c-bd71ad7a2864", "content": "On September 30, 2026, Cisco disclosed CVE-2026-76504, a critical API authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager, with a CVSS score of 9.8. It allows unauthenticated remote attackers to bypass authentication and access the API as an admin.", "url": "https://bsky.app/profile/securityrss.bsky.social/post/3mwslc4i5722m"}, {"timestamp": "2026-10-01T10:23:45.312Z", "date_only": false, "value": "2026-10-01T10:23:45.312879Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mwsnbphuic2w", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "38a5bff0-b5fc-4047-85c5-77be983b7bb6", "content": "New Cisco SD-WAN zero-day exploited in-the-wild (CVE-2026-76504)\n\n\ud83d\udcd6 Read more: www.helpnetsecurity.com/2026/10/01/n...\n\n#cybersecurity #cybersecuritynews #0day #exploit @cisco.com", "url": "https://bsky.app/profile/helpnetsecurity.com/post/3mwsnbphuic2w"}, {"timestamp": "2026-10-01T10:34:41Z", "date_only": false, "value": "2026-10-01T10:34:41.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/10214", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "1d519cc7-1152-4050-b0ff-e796123f750e", "content": "\ud83d\uded1 An actively exploited Cisco SD-WAN flaw can give unauthenticated attackers admin-level API access.\n\nCISA has added CVE-2026-76504 to its KEV catalog. Federal agencies have until Oct. 3 to apply the fix.\n\nWhat defenders should hunt for: https://thehackernews.com/2026/10/cisa-adds-exploited-cisco-catalyst-sd.html", "url": "https://t.me/thehackernews/10214"}, {"timestamp": "2026-10-01T10:34:41Z", "date_only": false, "value": "2026-10-01T10:34:41.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/thehackernews/10214", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "d6738bfe-11ea-494d-992f-b0200d4e6ee8", "content": "\ud83d\uded1 An actively exploited Cisco SD-WAN flaw can give unauthenticated attackers admin-level API access.\n\nCISA has added CVE-2026-76504 to its KEV catalog. Federal agencies have until Oct. 3 to apply the fix.\n\nWhat defenders should hunt for: https://thehackernews.com/2026/10/cisa-adds-exploited-cisco-catalyst-sd.html", "url": "https://t.me/thehackernews/10214"}, {"timestamp": "2026-10-01T10:35:40.187Z", "date_only": false, "value": "2026-10-01T10:35:40.187853Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mwsnx2wrxz2l", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "07fe384e-e902-437f-9ea7-81b896d09c34", "content": "Cisco SD-WAN\u306e\u65b0\u305f\u306a\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u304c\u60aa\u7528\u3055\u308c\u308b\uff08CVE-2026-76504\uff09\n\nCisco\u306f\u3001\u540c\u793e\u306eSD-WAN\u30bd\u30ea\u30e5\u30fc\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\uff08CVE-2026-76504\uff09\u304c\u30bc\u30ed\u30c7\u30a4\u653b\u6483\u3067\u60aa\u7528\u3055\u308c\u305f\u3053\u3068\u3092\u660e\u3089\u304b\u306b\u3057\u307e\u3057\u305f\u3002\u540c\u88fd\u54c1\u3067\u30bc\u30ed\u30c7\u30a4\u653b\u6483\u304c\u78ba\u8a8d\u3055\u308c\u305f\u306e\u306f\u3001\u4eca\u5e74\u306b\u5165\u3063\u30665\u4ef6\u76ee\u3067\u3059\u3002 \u540c\u793e\u306e\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u5bfe\u5fdc\u30c1\u30fc\u30e0\u304c\u3053\u306e\u8106\u5f31\u6027\u306e\u60aa\u7528\u3092\u628a\u63e1\u3057\u305f\u306e\u306f\u30012026\u5e749\u6708\u3067\u3059\u3002Cisco Tech", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mwsnx2wrxz2l"}, {"timestamp": "2026-10-01T10:45:14.248Z", "date_only": false, "value": "2026-10-01T10:45:14.248294Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mwsoi66fmt2v", "record": "cve-2026-76504", "field": "creation_timestamp", "uuid": "539717b4-15c4-4ca3-9f3a-13841481914c", "content": "Cisco SD-WAN Manager auth bypass (CVE-2026-76504, CVSS 9.8) is under active exploitation. Federal agencies have until Oct\u2026 https://0daynews.com/articles/2026-10-01-cisco-sd-wan-manager-cve-2026-76504-exploited/?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-4080", "url": "https://bsky.app/profile/0daynews.bsky.social/post/3mwsoi66fmt2v"}, {"timestamp": "2026-10-01T11:02:28.069Z", "date_only": false, "value": "2026-10-01T11:02:28.069769Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mwspgyqdy32l", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "ee76c035-66f4-4ff0-8872-3b5f7ae13a12", "content": "Critical Threat Advisory: Cisco Catalyst SD-WAN Manager (CVE-2026-76504)\n\nThreat Advisory: CVE-2026-76504 Affected Vendor/Product: Cisco - Catalyst SD-WAN Manager Vulnerability Type (CWE): N/A Operational Threat Level:...", "url": "https://bsky.app/profile/thecybermind.co/post/3mwspgyqdy32l"}, {"timestamp": "2026-10-01T11:06:04.108Z", "date_only": false, "value": "2026-10-01T11:06:04.108471Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mwspngvs5c26", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "1e98c6b2-c775-486a-871d-e7c641d3b15e", "content": "Critical Threat Advisory: Cisco Catalyst SD-WAN Manager (CVE-2026-76504)\n\nStrategic Threat Advisory: CVE-2026-76504 Affected Vendor & Product: Cisco - Catalyst SD-WAN Manager Vulnerability Class (CWE):...", "url": "https://bsky.app/profile/thecybermind.co/post/3mwspngvs5c26"}, {"timestamp": "2026-10-01T11:07:30.651Z", "date_only": false, "value": "2026-10-01T11:07:30.651475Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mwsppy625k2c", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "a5e87c0c-3fff-4d89-bcf7-bb550e204abc", "content": "New Cisco SD-WAN zero-day exploited in-the-wild (CVE-2026-76504)\n\nwww.helpnetsecurity.com/2026/10/01/n...\n\n#Kyberturvallisuus #Kyber #Tilannekuva", "url": "https://bsky.app/profile/hapsis.bsky.social/post/3mwsppy625k2c"}, {"timestamp": "2026-10-01T11:12:18.224Z", "date_only": false, "value": "2026-10-01T11:12:18.224563Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwspykhurl2m", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "26630181-a203-4441-988d-ddef79946566", "content": "CVE-2026-76504 in Cisco Catalyst SD-WAN Manager enables unauthenticated remote attackers to bypass authentication and access the admin API via crafted HTTP requests.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwspykhurl2m"}, {"timestamp": "2026-10-01T11:13:24.489Z", "date_only": false, "value": "2026-10-01T11:13:24.489804Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mwsq2kdzuc2i", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "3bfbe5a9-36aa-4aa7-9579-fb3d05b81fac", "content": "CVE-2026-76504 in Cisco Catalyst SD-WAN Manager enables unauthenticated remote attackers to bypass authentication and access the admin API via crafted HTTP requests.\n", "url": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mwsq2kdzuc2i"}, {"timestamp": "2026-10-01T11:13:46.975Z", "date_only": false, "value": "2026-10-01T11:13:46.975094Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mwsq36f6ho2c", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "fb5f4e76-f0e5-4ea2-86f4-b0e56dfd3b0c", "content": "CVE-2026-76504 in Cisco Catalyst SD-WAN Manager enables unauthenticated remote attackers to bypass authentication and access the admin API via crafted HTTP requests.\n", "url": "https://bsky.app/profile/privpros.bsky.social/post/3mwsq36f6ho2c"}, {"timestamp": "2026-10-01T11:15:27.068Z", "date_only": false, "value": "2026-10-01T11:15:27.068279Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwsq67mfzv2n", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "82f4b65e-594e-4512-b625-2380a09aa5ae", "content": "Cisco says CVE-2026-76504 is being exploited in zero-day attacks against Cisco Catalyst SD-WAN Manager, enabling API auth bypass and possible admin access. Fixes and IoCs are available. #Cisco #CVE202676504 #CISA", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwsq67mfzv2n"}, {"timestamp": "2026-10-01T11:16:24.760Z", "date_only": false, "value": "2026-10-01T11:16:24.760747Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mwsq7wlpv224", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "ee8136c7-69a6-420f-891d-341df81e2dc5", "content": "Critical Threat Advisory: Cisco Catalyst SD-WAN Manager (CVE-2026-76504)\n\nCISA\u2019s active exploitation verification of CVE-2026-76504 demands an immediate, high-priority posture adjustment across all Cisco Catalyst SD-WAN Manager\u2026...", "url": "https://bsky.app/profile/thecybermind.co/post/3mwsq7wlpv224"}, {"timestamp": "2026-10-01T11:30:45.860Z", "date_only": false, "value": "2026-10-01T11:30:45.860135Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yasna.io/post/3mwsqzlmlee2z", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "34e88608-66e0-443a-84e7-b405fe0b6c4f", "content": "A critical zero-day authentication bypass in Cisco Catalyst SD-WAN Manager (CVE-2026-76504) is actively exploited, prompting Cisco and CISA to issue alerts and fixes.\n\n#CVE #ZeroDay #infosec\n\nFull synthesis & sources: yasna.io", "url": "https://bsky.app/profile/yasna.io/post/3mwsqzlmlee2z"}, {"timestamp": "2026-10-01T12:23:36.603Z", "date_only": false, "value": "2026-10-01T12:23:36.603596Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/vuldb/statuses/117365631624798728", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "bc105d72-7673-4f50-900e-8833643ab8e1", "content": "We have just added an important vulnerability affecting Cisco Catalyst SD-WAN Manager (CVE-2026-76504) https://vuldb.com/vuln/412025", "url": "https://infosec.exchange/users/vuldb/statuses/117365631624798728"}, {"timestamp": "2026-10-01T12:27:52.606Z", "date_only": false, "value": "2026-10-01T12:27:52.606906Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mwsu7pu2ac2l", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "cc71a1b5-4136-47c0-a92d-aa2938d7f976", "content": "Critical Threat Advisory: Cisco Catalyst SD-WAN Manager (CVE-2026-76504)\n\nCISA\u2019s active exploitation verification of CVE-2026-76504 demands an immediate, high-priority posture adjustment across all Cisco Catalyst SD-WAN Manager\u2026...", "url": "https://bsky.app/profile/thecybermind.co/post/3mwsu7pu2ac2l"}, {"timestamp": "2026-10-01T12:53:36.655Z", "date_only": false, "value": "2026-10-01T12:53:36.655251Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwsvnq7axi2y", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "07a0fc83-8f13-4408-9ccf-8dd7972482a7", "content": "\ud83e\udd16 CVE-2026-76504 (CVSS 9.8): critical auth bypass in Cisco Catalyst SD-WAN Manager, actively exploited. CISA added it to KEV. Unauthenticated remote access to affected systems \u2014 patch now.\nhttps://thehackernews.com/2026/10/cisa-adds-exploited-cisco-catalyst-sd.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mwsvnq7axi2y"}, {"timestamp": "2026-10-01T12:58:36.070Z", "date_only": false, "value": "2026-10-01T12:58:36.070410Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwsvwm272c25", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "ebadad4f-6c66-4d7d-ad25-2a6edf93187d", "content": "Cisco warns of new SD-WAN zero-day exploited in attacks\n\nCisco\u00a0released security updates to address a critical zero-day in the Catalyst SD-WAN Manager (tracked as\u00a0CVE-2026-76504) that attackers are actively exploiting to\u00a0escalate to admin privileges. [...]\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwsvwm272c25"}, {"timestamp": "2026-10-01T13:15:05.366Z", "date_only": false, "value": "2026-10-01T13:15:05.366204Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mwswu5kies2k", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "8a901d36-cc57-4a86-b1d9-dc1bb03ec8db", "content": "\ud83d\udd17 CVE : CVE-2026-76504", "url": "https://bsky.app/profile/o2cloud.bsky.social/post/3mwswu5kies2k"}, {"timestamp": "2026-10-01T13:29:28.907Z", "date_only": false, "value": "2026-10-01T13:29:28.907633Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mwsxnsutla2l", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "9d5eb91c-4e09-4916-92fe-cc149b000e17", "content": "CVE-2026-76504 is trending. Hype score 3, currently #7 on cvemon.\n\nA vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-76504", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3mwsxnsutla2l"}, {"timestamp": "2026-10-01T13:41:20Z", "date_only": false, "value": "2026-10-01T13:41:20.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/2kRO7yG5gmgbUIwUQ-ym9Xl6JNEQT7pWBHQpTjh1u9EIyA", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "8e4388b5-1989-4c80-a8cd-af918240797a"}, {"timestamp": "2026-10-01T13:47:48.255Z", "date_only": false, "value": "2026-10-01T13:47:48.255974Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/robcampbell.bsky.social/post/3mwsyonarfs2q", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "5caf92d5-50c7-408f-83c5-097b00810330", "content": "Cisco says attackers are exploiting CVE-2026-76504 to gain admin access to Catalyst SD-WAN Manager. No workaround exists. Patch now.\n\nsec.cloudapps.cisco.com/security/cen...\n#Cybersecurity #Cisco", "url": "https://bsky.app/profile/robcampbell.bsky.social/post/3mwsyonarfs2q"}, {"timestamp": "2026-10-01T14:00:01Z", "date_only": false, "value": "2026-10-01T14:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-76504", "field": "timestamps.recorded_at", "uuid": "d5233a23-4682-413c-818a-709221feb653", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-01T14:00:38.047Z", "date_only": false, "value": "2026-10-01T14:00:38.047797Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d5233a23-4682-413c-818a-709221feb653", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "05fd4b8f-a2bd-43e0-8049-d049b7905387", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d5233a23-4682-413c-818a-709221feb653"}, {"timestamp": "2026-10-01T15:06:15.937Z", "date_only": false, "value": "2026-10-01T15:06:15.937725Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/dannypalmer.bsky.social/post/3mwt5362wmk2r", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "a91636f5-bd32-4387-923b-25004a24ecf6", "content": "New critical security vulnerability in Cisco Catalyst SD-WAN Manager just dropped. (CVE-2026-76504)\n\nCisco warned that attackers have already been seen using it in the wild...\n\nwww.infosecurity-magazine.com/news/critica...", "url": "https://bsky.app/profile/dannypalmer.bsky.social/post/3mwt5362wmk2r"}, {"timestamp": "2026-10-01T16:03:13.327Z", "date_only": false, "value": "2026-10-01T16:03:13.327015Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwtaap7yd52q", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "f310b9ab-8848-45a7-868b-e134946b3846", "content": "~Cybergcca~\nFive advisories urge updates; Cisco CVE-2026-76504 is actively exploited.\n-\nIOCs: CVE-2026-76504, CVE-2026-86134\n-\n#CVE-2026-76504 #CyberSecurity #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mwtaap7yd52q"}, {"timestamp": "2026-10-01T16:09:46.402Z", "date_only": false, "value": "2026-10-01T16:09:46.402500Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwtamdeucc2b", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "9f9c2f4d-678d-4b4c-bb0f-4ad439771636", "content": "5/ Cisco SD-WAN Manager flaw CVE-2026-76504 is exploited in the wild (login bypass). CISA deadline for US agencies: Oct 3. Fifth SD-WAN zero-day (unpatched-flaw attack) this year. via BleepingComputer", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwtamdeucc2b"}, {"timestamp": "2026-10-01T16:09:46.841Z", "date_only": false, "value": "2026-10-01T16:09:46.841843Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwtamdgaak2b", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "1f6e8d60-008a-4068-b74e-9a634e967ae4", "content": "5/ Cisco SD-WAN Manager flaw CVE-2026-76504 is exploited in the wild (login bypass). CISA deadline for US agencies: Oct 3. Fifth SD-WAN zero-day (unpatched-flaw attack) this year. via BleepingComputer", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwtamdgaak2b"}, {"timestamp": "2026-10-01T16:09:47.277Z", "date_only": false, "value": "2026-10-01T16:09:47.277413Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwtamdgd6c2b", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "b6903051-a8d3-4841-9636-83a550682f9e", "content": "5/ Cisco SD-WAN Manager flaw CVE-2026-76504 is exploited in the wild (login bypass). CISA deadline for US agencies: Oct 3. Fifth SD-WAN zero-day (unpatched-flaw attack) this year. via BleepingComputer", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwtamdgd6c2b"}, {"timestamp": "2026-10-01T16:09:47.714Z", "date_only": false, "value": "2026-10-01T16:09:47.714834Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwtamdgf4s2b", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "b059ee20-ee77-495a-a2fb-57245fd107b6", "content": "5/ Cisco SD-WAN Manager flaw CVE-2026-76504 is exploited in the wild (login bypass). CISA deadline for US agencies: Oct 3. Fifth SD-WAN zero-day (unpatched-flaw attack) this year. via BleepingComputer", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwtamdgf4s2b"}, {"timestamp": "2026-10-01T16:09:48.140Z", "date_only": false, "value": "2026-10-01T16:09:48.140820Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwtamdgjz22b", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "f91fa47e-aff6-4409-9e17-a10557da1384", "content": "5/ Cisco SD-WAN Manager flaw CVE-2026-76504 is exploited in the wild (login bypass). CISA deadline for US agencies: Oct 3. Fifth SD-WAN zero-day (unpatched-flaw attack) this year. via BleepingComputer", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwtamdgjz22b"}, {"timestamp": "2026-10-01T16:09:48.587Z", "date_only": false, "value": "2026-10-01T16:09:48.587322Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwtamdglxk2b", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "03ef5a39-ae0a-469b-b1c0-c4b77d04c45c", "content": "5/ Cisco SD-WAN Manager flaw CVE-2026-76504 is exploited in the wild (login bypass). CISA deadline for US agencies: Oct 3. Fifth SD-WAN zero-day (unpatched-flaw attack) this year. via BleepingComputer", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwtamdglxk2b"}, {"timestamp": "2026-10-01T16:09:49.042Z", "date_only": false, "value": "2026-10-01T16:09:49.042118Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwtamdgmws2b", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "ebf85faa-4417-47e3-94e5-4bc212f5e579", "content": "5/ Cisco SD-WAN Manager flaw CVE-2026-76504 is exploited in the wild (login bypass). CISA deadline for US agencies: Oct 3. Fifth SD-WAN zero-day (unpatched-flaw attack) this year. via BleepingComputer", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwtamdgmws2b"}, {"timestamp": "2026-10-01T16:09:49.502Z", "date_only": false, "value": "2026-10-01T16:09:49.502275Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwtamdh2mc2b", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "254e6ead-b4f0-4cbe-82eb-a327d43a9166", "content": "5/ Cisco SD-WAN Manager flaw CVE-2026-76504 is exploited in the wild (login bypass). CISA deadline for US agencies: Oct 3. Fifth SD-WAN zero-day (unpatched-flaw attack) this year. via BleepingComputer", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwtamdh2mc2b"}, {"timestamp": "2026-10-01T17:20:43.677Z", "date_only": false, "value": "2026-10-01T17:20:43.677386Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwtelepzxg2t", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "14a16348-3a0d-4f8f-b1bb-38b640d19f29", "content": "Cisco patches critical auth bypass zero-day (CVE-2026-76504) in Catalyst SD-WAN Manager. CVSS 9.8 flaw actively exploited. Unauthenticated attackers can gain admin access. CISA added to KEV. Patch immediately! #Cisco #ZeroDay #SDWAN #CVE202676504\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mwtelepzxg2t"}, {"timestamp": "2026-10-01T17:20:46.448Z", "date_only": false, "value": "2026-10-01T17:20:46.448949Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117366798192919122", "record": "cve-2026-76504", "field": "creation_timestamp", "uuid": "ab61c617-984c-4f2b-9441-d0b9626ed452", "content": "\ud83d\udcf0 Cisco Patches Actively Exploited SD-WAN Auth Bypass Zero-Day\nCisco patches critical auth bypass zero-day (CVE-2026-76504) in Catalyst SD-WAN Manager. CVSS 9.8 flaw actively exploited. Unauthenticated attackers can gain admin access. CISA added to KEV. Patch immediately! #Cisco #ZeroDay #SDWAN #CVE202676504\n\ud83d\udd17 https://cyber.netsecops.io/articles/cisco-patches-actively-exploited-sd-wan-zero-day-cve-2026-76504/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/117366798192919122"}, {"timestamp": "2026-10-01T17:30:31Z", "date_only": false, "value": "2026-10-01T17:30:31.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/516173c41df42470cfdef2c71513bc87", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "cd50c82d-7836-44f9-9083-a3ed903f8ef2", "content": "# CVE-2026-76504: CVE-2026-76504: Unauthenticated Authentication Bypass in Cisco Catalyst SD-WAN Manager\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-09-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-76504\n\n## Summary\nCVE-2026-76504 is a critical vulnerability in the web-based management console of Cisco Catalyst SD-WAN Manager. Due to improper normalization and handling of hex/percent-encoded sequences (CWE-177) within incoming request URIs, remote, unauthenticated attackers can bypass administrative authentication controls. Successful exploitation permits full remote administrative command execution on the SD-WAN management plane, threatening the integrity and availability of the managed network fabric.\n\n## TL;DR\nAn unauthenticated remote authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager allows attackers to perform administrative actions with root-level privileges by exploiting inconsistency in URI hex/percent-encoding handling across web application layers.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-177 (Improper Handling of URL Encoding)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 9.8\n- **Exploit Status**: active\n- **CISA KEV Listed**: Yes (Added September 30, 2026)\n- **Impact**: Complete administrative compromise of SD-WAN management interface\n\n## Affected Systems\n\n- Cisco Catalyst SD-WAN Manager (formerly vManage)\n- **Catalyst SD-WAN Manager**: < 20.9.10.1 (Fixed in: `20.9.10.1`)\n- **Catalyst SD-WAN Manager**: >= 20.12.0.0, < 20.12.8.2 (Fixed in: `20.12.8.2`)\n- **Catalyst SD-WAN Manager**: >= 20.15.0.0, < 20.15.6.1 (Fixed in: `20.15.6.1`)\n- **Catalyst SD-WAN Manager**: >= 20.18.0.0, < 20.18.4.1 (Fixed in: `20.18.4.1`)\n- **Catalyst SD-WAN Manager**: >= 26.1.0.0, < 26.1.2.1 (Fixed in: `26.1.2.1`)\n- **Catalyst SD-WAN Manager**: >= 26.2.0.0, < 26.2.1 (Fixed in: `26.2.1`)\n\n## Mitigation\n\n- De-expose Cisco Catalyst SD-WAN Manager management interfaces from the public internet.\n- Implement restrictive local network and firewall Access Control Lists (ACLs) to allow traffic only from designated, trusted administrative hosts.\n- Enforce authentication protocols at the network perimeter, such as requiring VPN or Multi-Factor authenticated jump servers to access administrative zones.\n\n**Remediation Steps:**\n1. Identify the current software generation of all deployed Catalyst SD-WAN Manager instances.\n2. Cross-reference the running version against the fixed release matrix to determine the correct target firmware path.\n3. Schedule emergency maintenance windows to deploy the updated software versions.\n4. Verify that the web interface is inaccessible via paths containing double-escaped or percent-encoded traversal indicators.\n\n## References\n\n- [Cisco Security Advisory: Cisco Catalyst SD-WAN Manager Authentication Bypass Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU)\n- [CISA KEV Catalog Reference for CVE-2026-76504](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76504)\n- [CVE-2026-76504 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-76504)\n- [NVD Vulnerability Details for CVE-2026-76504](https://nvd.nist.gov/vuln/detail/CVE-2026-76504)\n- [ShadowForge Cyber Exploit Verification Repository](https://github.com/ShadowForge-Cyber/CVE-2026-76504-Proof-of-concept)\n- [ShadowForge Cyber Vulnerability Verification Documentation](https://raw.githubusercontent.com/ShadowForge-Cyber/CVE-2026-76504-Proof-of-concept/main/README.md)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-76504) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/516173c41df42470cfdef2c71513bc87"}, {"timestamp": "2026-10-01T20:53:34.221Z", "date_only": false, "value": "2026-10-01T20:53:34.221564Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mwtqhwpvx62l", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "42cae812-c408-4a74-972a-390bfc0b6fdd", "content": "CVE-2026-76504: Critical Cisco SD-WAN Manager Zero\n\nThis article focuses heavily on detection tools like SOC Prime and Uncoder AI, but it understates the immediate risk posed by an unauthenticated administrative bypass, which requires foundational network segmentation rather than just advanced c\u2026", "url": "https://bsky.app/profile/arc-codex.com/post/3mwtqhwpvx62l"}, {"timestamp": "2026-10-01T21:13:14.369Z", "date_only": false, "value": "2026-10-01T21:13:14.369838Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/catc0n/statuses/117367714204953673", "record": "cve-2026-76504", "field": "creation_timestamp", "uuid": "50be95cd-2492-42fd-932d-e5c75adb73b6", "content": "Cisco SD-WAN CVE-2026-76504 analysis and exploit walk-through available c/o Landon Rice on the @vulncheck team \u3299\ufe0f \nhttps://www.vulncheck.com/blog/revenge-of-the-sd-wan-cve-2026-76504", "url": "https://infosec.exchange/users/catc0n/statuses/117367714204953673"}, {"timestamp": "2026-10-01T23:36:15.243Z", "date_only": false, "value": "2026-10-01T23:36:15.243754Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alien-rick.bsky.social/post/3mwtzkrwwmk2x", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "98e10632-6137-4988-b488-a96688652873", "content": "So wait, Cisco's SD-WAN admin login dies if you hex-encode the letter j? *burp* CVE-2026-76504 is CVSS 9.8 and already on CISA's KEV fridge. Your whole WAN is one URI typo from freeloaders, schmeckles refunded. day275.008", "url": "https://bsky.app/profile/alien-rick.bsky.social/post/3mwtzkrwwmk2x"}, {"timestamp": "2026-10-02T04:55:52.695Z", "date_only": false, "value": "2026-10-02T04:55:52.695233Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mwulgfxez62d", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "030debcd-7951-4579-9d65-4b6c382c2485", "content": "Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability (CVE-2026-76504) #patchmanagement", "url": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mwulgfxez62d"}, {"timestamp": "2026-10-02T05:55:48.601Z", "date_only": false, "value": "2026-10-02T05:55:48.601547Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mwuorkgfv62s", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "ca10d040-206e-4f39-8385-ffb229118b74", "content": "\ud83d\udee1\ufe0f Revue cyber du 2 octobre :\n\n\u2022 CERT-FR : faille Cisco SD-WAN (CVE-2026-76504) exploit\u00e9e activement.\nhttps://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1246/\n\n\u2022 Fortinet : critique FortiMail exploit\u00e9e en 0-day.", "url": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mwuorkgfv62s"}, {"timestamp": "2026-10-02T06:31:11.744Z", "date_only": false, "value": "2026-10-02T06:31:11.744898Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mwuqqu5xr32h", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "92db04af-4e05-47c1-8e62-7f2fd50f4492", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-76504: \u26a0\ufe0f CVE-2026-76504: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 1.1%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-76504-a-vulnerability-in-the-api-session-based", "url": "https://bsky.app/profile/threatspotai.bsky.social/post/3mwuqqu5xr32h"}, {"timestamp": "2026-10-02T06:33:22.872Z", "date_only": false, "value": "2026-10-02T06:33:22.872101Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mwuquqzsjm2p", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "85f8e9f8-0383-4c38-bdbb-56396c99f551", "content": "Here we go again with Cisco Catalyst SD-WAN Manager users discovering that basic hex encoding was apparently too difficult to parse properly. Thanks to CVE-2026-76504, remote opportunists have been casually awarding themselves administrative API access in the wild without needing...\n\nRead full story", "url": "https://bsky.app/profile/cerberusit.bsky.social/post/3mwuquqzsjm2p"}, {"timestamp": "2026-10-02T06:53:24.026Z", "date_only": false, "value": "2026-10-02T06:53:24.026612Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwuryfv25s2f", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "14cb9edf-d6b7-44e7-a8d2-a69e0d35206c", "content": "\ud83d\udd34 Cisco SD-WAN CVE-2026-76504 \u2014 zero-day under active attack\nCritical CVSS 9.8 auth bypass lets remote attackers access Catalyst SD-WAN Manager APIs with admin privileges \u2014 no password required.\nstemshop.top/blog/cisco-s...\n#CVE #CVE202676504 #Cisco #SDWAN #ZeroDay #CyberSecurity", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mwuryfv25s2f"}, {"timestamp": "2026-10-02T11:57:20.769Z", "date_only": false, "value": "2026-10-02T11:57:20.769879Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybereyeq.bsky.social/post/3mwvcy2ewyl2q", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "24a3af72-f016-486c-9c63-205481f9bfe7", "content": "Critical Cisco Catalyst SD-WAN Manager auth-bypass (CVE-2026-76504, CVSS 9.8) hit CISA's KEV catalog on 30 Sep. Federal fix due 3 Oct under BOD 26-04. https://www.cybereyeq.com/?utm_source=bluesky&utm_medium=social&utm_campaign=cisco_sdwan_kev", "url": "https://bsky.app/profile/cybereyeq.bsky.social/post/3mwvcy2ewyl2q"}, {"timestamp": "2026-10-02T14:17:34.465Z", "date_only": false, "value": "2026-10-02T14:17:34.465589Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwvkssf53g2s", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "8fd242a8-cb14-4c29-be6f-c11a9df3cae2", "content": "Cisco patches critical auth bypass zero-day (CVE-2026-76504) in Catalyst SD-WAN Manager. CVSS 9.8 flaw actively exploited. Unauthenticated attackers can gain admin access. CISA added to KEV. Patch immediately! #Cisco #ZeroDay #SDWAN #CVE202676504\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mwvkssf53g2s"}, {"timestamp": "2026-10-02T17:33:40.777Z", "date_only": false, "value": "2026-10-02T17:33:40.777742Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/packetstorm.bsky.social/post/3mwvvrhpve32n", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "09ceae34-ddd4-45c0-843e-967a0dc1b760", "content": "Revenge of the SD-WAN: Exploring and Exploiting yet Another Critical Cisco SD-WAN Vulnerability (CVE-2026-76504) https://packetstorm.news/news/view/44586 #news", "url": "https://bsky.app/profile/packetstorm.bsky.social/post/3mwvvrhpve32n"}, {"timestamp": "2026-10-02T20:15:50.666Z", "date_only": false, "value": "2026-10-02T20:15:50.666513Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/insomnisec.bsky.social/post/3mww6tgmr3a2u", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "061af895-ef64-4ab6-9f33-f1fc466c8eae", "content": "\ud83d\udce1 Cisco Catalyst SD-WAN Manager Zero-Day (CVE-2026-76504): One Encoded Letter Away From Admin", "url": "https://bsky.app/profile/insomnisec.bsky.social/post/3mww6tgmr3a2u"}, {"timestamp": "2026-10-02T23:18:42Z", "date_only": false, "value": "2026-10-02T23:18:42+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_cisco \u00b7 CISCO-SA-SDWAN-WEBAUTH-XR8BEUUU", "record": "CISCO-SA-SDWAN-WEBAUTH-XR8BEUUU", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-02T23:18:42Z", "date_only": false, "value": "2026-10-02T23:18:42+00:00", "kind": "other", "label": "Updated", "source": "csaf_cisco \u00b7 CISCO-SA-SDWAN-WEBAUTH-XR8BEUUU", "record": "CISCO-SA-SDWAN-WEBAUTH-XR8BEUUU", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-02T23:18:44Z", "date_only": false, "value": "2026-10-02T23:18:44+00:00", "kind": "other", "label": "Document generated", "source": "csaf_cisco \u00b7 CISCO-SA-SDWAN-WEBAUTH-XR8BEUUU", "record": "CISCO-SA-SDWAN-WEBAUTH-XR8BEUUU", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-02T23:23:29.275Z", "date_only": false, "value": "2026-10-02T23:23:29.275Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-76504", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-02T23:23:29.275Z", "date_only": false, "value": "2026-10-02T23:23:29.275Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / cisco", "record": "CVE-2026-76504", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-03T00:00:00Z", "date_only": true, "value": "2026-10-03", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-76504", "field": "evidence.0.details.due_date", "uuid": "f5bc2a87-dc34-47c6-ac53-71cf2a28f1ac", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-03T00:16:39.140Z", "date_only": false, "value": "2026-10-03T00:16:39.140", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-76504", "record": "FKIE_CVE-2026-76504", "field": "lastModified"}, {"timestamp": "2026-10-03T08:07:51.546Z", "date_only": false, "value": "2026-10-03T08:07:51.546025Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/billingsley.bsky.social/post/3mwxgmlgk5l2h", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "e945ab9c-4d7d-4b2e-9f05-351cd7ed5572", "content": "COGNOSCERE Tech Brief \u2014 2026-10-03\n\nCisco disclosed CVE-2026-76504, a CVSS 9.8 authentication bypass in Catalyst SD-\n\nhttps://www.cognoscerellc.com/news", "url": "https://bsky.app/profile/billingsley.bsky.social/post/3mwxgmlgk5l2h"}, {"timestamp": "2026-10-03T08:42:14.252Z", "date_only": false, "value": "2026-10-03T08:42:14.252331Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/digitalpulsebrief.bsky.social/post/3mwxik33xeo25", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "6d9fd85a-d2b4-4f2f-896e-cd7862368eb8", "content": "Cisco SD-WAN CVE-2026-76504 Is Being Exploited: Fixed Versions, Detection Steps and What Admins Should Do\u00a0Now\n\nCisco confirms active exploitation of CVE-2026-76504 in Catalyst SD-WAN Manager. Here are the fixed versions, Cisco\u2019s response workflow, detection guidance, and the limits of the new Live\u2026", "url": "https://bsky.app/profile/digitalpulsebrief.bsky.social/post/3mwxik33xeo25"}, {"timestamp": "2026-10-03T14:19:18.062Z", "date_only": false, "value": "2026-10-03T14:19:18.062198Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/samilaiho.com/post/3mwy3eo2drk2j", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "fc6309e6-9e35-46a3-a3f8-db7c5a39d21c", "content": "Revenge of the SD-WAN: Exploring and Exploiting Yet Another Critical Cisco\nSD-WAN Vulnerability (CVE-2026-76504)\nwww.vulncheck.com/blog/revenge...", "url": "https://bsky.app/profile/samilaiho.com/post/3mwy3eo2drk2j"}, {"timestamp": "2026-10-04T08:10:39.847Z", "date_only": false, "value": "2026-10-04T08:10:39.847272Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/billingsley.bsky.social/post/3mwzxaipxjt2h", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "c0d94927-212d-41aa-9294-282b4cfe7d7e", "content": "COGNOSCERE Tech Brief \u2014 2026-10-04\n\nCisco disclosed CVE-2026-76504, a CVSS 9.8 authentication bypass in Catalyst SD-\n\nhttps://youtube.com/watch?v=C1YrJA1iwf0\n\nhttps://www.cognoscerellc.com/news", "url": "https://bsky.app/profile/billingsley.bsky.social/post/3mwzxaipxjt2h"}, {"timestamp": "2026-10-04T08:30:16.327Z", "date_only": false, "value": "2026-10-04T08:30:16.327333Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/csirts.com/post/3mwzydm27k32q", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "c0153706-5cc6-4a91-b91e-8b3d4e22a58a", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-76504", "url": "https://bsky.app/profile/csirts.com/post/3mwzydm27k32q"}, {"timestamp": "2026-10-05T08:11:11.089Z", "date_only": false, "value": "2026-10-05T08:11:11.089963Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/billingsley.bsky.social/post/3mx4hqdi3322z", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "df28b030-f81c-4218-8d80-44b4a0f5a0cc", "content": "COGNOSCERE Tech Brief \u2014 2026-10-05\n\nCisco confirmed active exploitation of CVE-2026-76504, a critical authentication\n\nhttps://youtube.com/watch?v=XFyi_PgEpEc\n\nhttps://www.cognoscerellc.com/news", "url": "https://bsky.app/profile/billingsley.bsky.social/post/3mx4hqdi3322z"}, {"timestamp": "2026-10-05T11:45:21.124Z", "date_only": false, "value": "2026-10-05T11:45:21.124771Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117388130434418795", "record": "cve-2026-76504", "field": "creation_timestamp", "uuid": "89581476-6a3e-4960-954d-4aab095dabc8", "content": "Revenge of the SD-WAN: Exploring and Exploiting Yet Another Critical Cisco SD-WAN Vulnerability (CVE-2026-76504)\nCisco has disclosed CVE-2026-76504, a critical authentication bypass in SD-WAN vManage disclosed as an exploited zero-day: any unauthenticated attacker can obtain a fully valid admin-level session with a single POST request. VulnCheck\u2019s exploit development team reproduced the flaw, built detection artifacts, and currently finds about 1,500 internet-exposed vManage devices. There are no legitimate public exploits yet, though the researchers note at least one fake is circulating. https://www.vulncheck.com/blog/revenge-of-the-sd-wan-cve-2026-76504", "url": "https://infosec.exchange/users/edwardk/statuses/117388130434418795"}, {"timestamp": "2026-10-05T11:45:21.947Z", "date_only": false, "value": "2026-10-05T11:45:21.947945Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mx4tpf7pch2g", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "73e745fb-a5aa-4cc3-90ee-cc095d1c9323", "content": "Revenge of the SD-WAN: Exploring and Exploiting Yet Another Critical Cisco SD-WAN Vulnerability (CVE-2026-76504)\n\nCisco has disclosed CVE-2026-76504, a critical authentication bypass in SD-WAN vManage disclosed as an exploited ... https://threatintel.cc/2026/10/05/revenge-of-the-sdwan-exploring.html", "url": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mx4tpf7pch2g"}, {"timestamp": "2026-10-05T12:05:44Z", "date_only": false, "value": "2026-10-05T12:05:44.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/kasperskyb2b/2332", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "14a350cd-6e29-47de-9b5b-d03b6256d518", "content": "\ud83d\udd25 \u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f APT \u0438 \u043d\u043e\u0432\u043e\u0441\u0442\u0438 \u0418\u0411 \u0437\u0430 \u043d\u0435\u0434\u0435\u043b\u044e\n\n\ud83d\ude31 \u0410\u043d\u0430\u043b\u0438\u0437 \u043c\u043e\u0434\u0443\u043b\u044c\u043d\u043e\u0433\u043e \u0412\u041f\u041e NeedyMantis, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0433\u0440\u0443\u043f\u043f\u043e\u0439 Storm-3069, \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0435\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u043f\u043e\u0441\u0442\u0430\u0432\u043e\u043a DAEMON Tools. \u0410\u0442\u0430\u043a\u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u0442\u0435\u043b\u0435\u043a\u043e\u043c, \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u044b \u0438 \u0433\u043e\u0441\u043f\u043e\u0434\u0440\u044f\u0434\u0447\u0438\u043a\u043e\u0432. \n\n\ud83d\udfe2\u0420\u0430\u0437\u0431\u043e\u0440 TTPs UAT-11587 \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0433\u0440\u0443\u043f\u043f\u043e\u0439 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 Antino. \u0421 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0444\u0438\u0448\u0438\u043d\u0433\u0430 \u0431\u044b\u043b\u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0433\u043e\u0441\u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0432 \u0432\u043e\u0441\u044c\u043c\u0438 \u0441\u0442\u0440\u0430\u043d\u0430\u0445,  \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0422\u0430\u0439\u0432\u0430\u043d\u044c, \u0418\u043d\u0434\u0438\u044e, \u0424\u0438\u043b\u0438\u043f\u043f\u0438\u043d\u044b \u0438 \u041f\u0430\u043a\u0438\u0441\u0442\u0430\u043d. \u0411\u044d\u043a\u0434\u043e\u0440 \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 Rust \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 OneDrive \u0438 Outlook \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 C2. \n\n\ud83d\udfe2\u041d\u043e\u0432\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f RedFlick \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 Python-\u0431\u044d\u043a\u0434\u043e\u0440 CosmicPulse \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0437\u0430\u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0437\u0430\u0434\u0430\u0447 (scheduled tasks). \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043e\u0442\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043e\u0442 \u043f\u0440\u0435\u0436\u043d\u0435\u0439 \u0442\u0430\u043a\u0442\u0438\u043a\u0438 ClickFix, \u0447\u0442\u043e\u0431\u044b \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0435 \u0432\u043e\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n\ud83d\udfe2\u041d\u043e\u0432\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 Mimbrob \u0430\u0442\u0430\u043a\u0443\u0435\u0442 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043e\u0431\u043e\u0440\u043e\u043d\u043d\u044b\u0435 \u0438 \u0418\u0422-\u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0430\u0440\u0445\u0438\u0432\u043e\u0432 \u0438 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 DLL Sideloading \u043d\u0430 \u0431\u0430\u0437\u0435 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 Yandex Browser \u0438 Notepad++. \u041f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0412\u041f\u041e FBULoader \u0438 RAT-Go.  \n\n\ud83d\udd35\u0412\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 DragonForce \u0432\u0437\u044f\u043b\u0430 \u043d\u0430 \u0432\u043e\u043e\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0434\u0432\u0430 \u043d\u043e\u0432\u044b\u0445 \u0431\u044d\u043a\u0434\u043e\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u044e\u0442 C2-\u0442\u0440\u0430\u0444\u0438\u043a \u0432 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 TURN \u0438 MQTT. \n\n\ud83d\udd35\u0420\u0430\u0437\u0431\u043e\u0440 Linux-\u0412\u041f\u041e JITTERLY \u0438 \u0440\u0443\u0442\u043a\u0438\u0442\u0430 SIXZUT, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u0433\u0440\u0443\u043f\u043f\u044b Red Heron, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Gitea. \u0410\u0442\u0430\u043a\u0438 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0438 \u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0441\u043f\u0435\u043a\u0442\u0440 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0432 \u042e\u0412\u0410 \u0438 \u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0435, \u0446\u0435\u043b\u044c\u044e, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0431\u044b\u043b \u0441\u0431\u043e\u0440 \u0440\u0430\u0437\u0432\u0435\u0434\u0434\u0430\u043d\u043d\u044b\u0445. \n\n\ud83d\udfe3\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u043e\u0445\u0438\u0442\u0438\u043b\u0438 $388 \u043c\u043b\u043d \u0443 \u043a\u0440\u0438\u043f\u0442\u043e\u0431\u0438\u0440\u0436\u0438 Bitget, \u043f\u0440\u043e\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0432 \u0437\u0438\u0440\u043e\u0434\u0435\u0439 \u0432 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u043c \u0418\u0411-\u0440\u0435\u0448\u0435\u043d\u0438\u0438 \u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0432 \u043c\u043e\u0448\u0435\u043d\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0432\u044b\u0432\u043e\u0434 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u0432 \u0431\u044d\u043a\u0435\u043d\u0434 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \n\n\ud83d\udfe3\u0421\u0442\u0438\u043b\u0435\u0440\u044b, \u043f\u0440\u043e\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0435 \u043d\u0430 \u043f\u043e\u0434\u043f\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u043e\u0440\u0443\u043c\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Bee Stealer \u0438 AVENGER \u0434\u043b\u044f macOS, \u0442\u0435\u043f\u0435\u0440\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 LLM \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0444\u0438\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0436\u0435\u0440\u0442\u0432 \u043f\u043e \u043f\u0440\u043e\u0444\u0435\u0441\u0441\u0438\u0438, \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u0430\u043c, \u043c\u0435\u0441\u0442\u0443 \u0440\u0430\u0431\u043e\u0442\u044b, \u0431\u0430\u043d\u043a\u0430\u043c \u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0430\u043a\u0442\u0438\u0432\u0430\u043c. \n\n\ud83d\udfe3\u0410\u043d\u0430\u043b\u0438\u0437 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0440\u0435\u043a\u043b\u0430\u043c\u043d\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0432 \u043f\u043e\u0438\u0441\u043a\u043e\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0433\u0434\u0435 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0443 ChatGPT \u0432\u0435\u043b\u0438 \u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0439 Custom GPT \u043d\u0430 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u043c \u0434\u043e\u043c\u0435\u043d\u0435 chatgpt[.]com, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u043b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443 ClickFix \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0412\u041f\u041e. \n\n\ud83d\udd35\u0420\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0441\u044e\u0436\u0435\u0442 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0437\u0438\u0440\u043e\u0434\u0435\u044f \u0432 Citrix NetScaler ADC \u0438 Gateway (CVE-2026-88771 \u0438 -88772),  \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0438\u0437 \u0433\u043e\u0441\u0441\u0435\u043a\u0442\u043e\u0440\u0430, \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u0439, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u0439, \u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0438 \u044e\u0440\u0438\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0441\u0444\u0435\u0440 \u0432 \u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0435 \u0438 \u0415\u0432\u0440\u043e\u043f\u0435. \u0412 \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043d\u043d\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0440\u0430\u0437\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u043b\u0438 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b WHIPSHOT \u0438 \u0412\u041f\u041e \u0434\u043b\u044f \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f SLAPSHOT.\n\n\ud83d\udd35Cisco \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043f\u0430\u0442\u0447 \u0434\u043b\u044f CVE-2026-76504 (CVSS 9.8) \u2014 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Catalyst SD-WAN Manager, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u0430\u0451\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f. \n\n\ud83d\udfe3\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 CVE-2026-73570 (\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u043a\u043e\u043c\u0430\u043d\u0434 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Zimbra Collaboration Suite, \u0437\u0430\u043a\u0440\u044b\u0442\u0443\u044e \u0435\u0449\u0451 \u0432 \u0438\u044e\u043b\u0435) \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0451\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u043e\u0432, \u043a\u0440\u0430\u0436\u0438 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u044d\u043a\u0441\u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u043e\u0447\u0442\u044b. \n\n\ud83d\udd34TeamViewer \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u043f\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 15.82. \u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u0430\u044f \u0438\u0437 \u043d\u0438\u0445 \u2014 CVE-2026-92370 (CVSS 8.8), \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0435\u0441\u0441\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a RCE. \n\n#APT #\u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442 @\u041f2\u0422", "url": "https://t.me/kasperskyb2b/2332"}, {"timestamp": "2026-10-05T16:08:18.499Z", "date_only": false, "value": "2026-10-05T16:08:18.499936Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mx5cfk75ju23", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "6f7e6d20-9279-43e3-a5a3-b58b63670738", "content": "~Checkpoint~\nActive exploitation, ransomware, phishing, AI-enabled attacks and major breaches reported.\n-\nIOCs: CVE-2026-76504, CVE-2026-88771, CVE-2026-90970\n-\n#CVE #Ransomware #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mx5cfk75ju23"}, {"timestamp": "2026-10-09T20:22:19Z", "date_only": false, "value": "2026-10-09T20:22:19+00:00", "kind": "kev", "label": "Asserted", "source": "shadowserver", "record": "CVE-2026-76504", "field": "timestamps.asserted_at", "uuid": "93e45084-36dc-4eaf-87ea-c70bb207c18d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-09T20:22:19Z", "date_only": false, "value": "2026-10-09T20:22:19+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2026-76504", "field": "timestamps.first_seen_at", "uuid": "93e45084-36dc-4eaf-87ea-c70bb207c18d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-10T04:01:47.319Z", "date_only": false, "value": "2026-10-10T04:01:47.319293Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mxim52h3rr2j", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "78556c25-3e4b-478a-8e66-c46904830af0", "content": "BREAKING: Cisco SD-WAN auth bypass CVE-2026-76504 (CVSS 9.8) added to CISA KEV \u2014 actively exploited for admin access; FCEB deadline hit. Also: SonicWall SMA 1000 SSRF CVE-2026-102255 (CVSS 10.0) added to KEV \u2014 2nd max-sev flaw in 5 weeks. Patch now. (TheHackerNews/Tech Insider) #CyberSecurity", "url": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mxim52h3rr2j"}, {"timestamp": "2026-10-11T19:41:46.848Z", "date_only": false, "value": "2026-10-11T19:41:46.848365Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117423977628674266", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "653e3b31-459d-4755-8a55-34dcd7f80118", "content": "\ud83d\udcf0 Cisco and SonicWall Flaws Under Active Exploit; CISA Issues KEVs\n\ud83d\udea8 CRITICAL PATCH NOW: Actively exploited zero-days in Cisco Catalyst SD-WAN Manager (CVE-2026-76504) & SonicWall SMA 1000 (CVE-2026-102255) added to CISA KEV. Flaws allow auth bypass & RCE. #Vulnerability #PatchTuesday #CISA\n\ud83d\udd17 https://cyber.netsecops.io/articles/cisco-and-sonicwall-zero-day-vulnerabilities-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/117423977628674266"}, {"timestamp": "2026-10-11T19:41:59.783Z", "date_only": false, "value": "2026-10-11T19:41:59.783614Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mxmr56dfgl24", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "306f1c4b-1a89-4eb2-a75a-0f62cea49b48", "content": "\ud83d\udea8 CRITICAL PATCH NOW: Actively exploited zero-days in Cisco Catalyst SD-WAN Manager (CVE-2026-76504) & SonicWall SMA 1000 (CVE-2026-102255) added to CISA KEV. Flaws allow auth bypass & RCE. #Vulnerability #PatchTuesday #CISA\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mxmr56dfgl24"}, {"timestamp": "2026-10-12T13:55:16.229Z", "date_only": false, "value": "2026-10-12T13:55:16.229038Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117428277049634772", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "f505f819-c35e-4e32-b5f9-db0d786e48c5", "content": "\ud83d\udcf0 Cisco and SonicWall Flaws Under Active Exploit; CISA Issues KEVs\n\ud83d\udea8 CRITICAL PATCH NOW: Actively exploited zero-days in Cisco Catalyst SD-WAN Manager (CVE-2026-76504) & SonicWall SMA 1000 (CVE-2026-102255) added to CISA KEV. Flaws allow auth bypass & RCE. #Vulnerability #PatchTuesday #CISA\n\ud83d\udd17 https://cyber.netsecops.io/articles/cisco-and-sonicwall-zero-day-vulnerabilities-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/117428277049634772"}, {"timestamp": "2026-10-12T13:55:35.387Z", "date_only": false, "value": "2026-10-12T13:55:35.387176Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mxooap7t5x23", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "788cbd5a-ea3a-42e9-92de-ea5be6feb8fe", "content": "\ud83d\udea8 CRITICAL PATCH NOW: Actively exploited zero-days in Cisco Catalyst SD-WAN Manager (CVE-2026-76504) & SonicWall SMA 1000 (CVE-2026-102255) added to CISA KEV. Flaws allow auth bypass & RCE. #Vulnerability #PatchTuesday #CISA\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mxooap7t5x23"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": false, "value": "2026-10-13T00:00:00+00:00", "kind": "kev", "label": "Last seen", "source": "shadowserver", "record": "CVE-2026-76504", "field": "timestamps.last_seen_at", "uuid": "93e45084-36dc-4eaf-87ea-c70bb207c18d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "kev", "label": "Observation date", "source": "shadowserver", "record": "CVE-2026-76504", "field": "evidence.0.details.observation_date", "uuid": "93e45084-36dc-4eaf-87ea-c70bb207c18d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": false, "value": "2026-10-13T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "shadowserver", "record": "CVE-2026-76504", "field": "status.status_updated_at", "uuid": "93e45084-36dc-4eaf-87ea-c70bb207c18d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-14T15:02:25.758Z", "date_only": false, "value": "2026-10-14T15:02:25.758602Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/oxfemale.bsky.social/post/3mxtsvzhsz42e", "record": "cve-2026-76504", "field": "creation_timestamp", "uuid": "9f44354b-8d0c-4c26-b3d1-fbf8dd30fa3c", "content": "Original text: \"Revenge of the SD-WAN: Exploring and Exploiting Yet Another Critical Cisco SD-WAN Vulnerability (CVE-2026-76504)\" \u2014 Landon Rice, VulnCheck (1 October 2026). Code, tables and figures below are reproduced verbatim with \nhttps://core-jmp.org/2026/10/revenge-of-the-sd-wan-cve-2026-76504/", "url": "https://bsky.app/profile/oxfemale.bsky.social/post/3mxtsvzhsz42e"}, {"timestamp": "2026-10-14T17:01:22.269Z", "date_only": false, "value": "2026-10-14T17:01:22.269452Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzkq6k5m2f", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "1e749d66-a0b4-4b25-8af1-431e95ad644c", "content": "Cisco Catalyst SD-WAN Manager: Actively Exploited Vulnerability Grants Attackers Admin Access\n\nOn September 30, 2026, Cisco patched the vulnerability CVE-2026-76504 (CVSS 9.8) in the Catalyst SD-WAN Manager.\n(1/3)", "url": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzkq6k5m2f"}, {"timestamp": "2026-10-14T17:01:22.685Z", "date_only": false, "value": "2026-10-14T17:01:22.685821Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzkq6swu2f", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "b991bdc0-8067-4000-a8fe-b5a9d41dc5ba", "content": "Cisco Catalyst SD-WAN Manager: Actively Exploited Vulnerability Grants Attackers Admin Access\n\nOn September 30, 2026, Cisco patched the vulnerability CVE-2026-76504 (CVSS 9.8) in the Catalyst SD-WAN Manager.\n(1/3)", "url": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzkq6swu2f"}, {"timestamp": "2026-10-14T17:01:23.140Z", "date_only": false, "value": "2026-10-14T17:01:23.140478Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzkq6tw42f", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "bab0a0dc-32b0-4f36-acb7-e3afbd50d13e", "content": "Cisco Catalyst SD-WAN Manager: Actively Exploited Vulnerability Grants Attackers Admin Access\n\nOn September 30, 2026, Cisco patched the vulnerability CVE-2026-76504 (CVSS 9.8) in the Catalyst SD-WAN Manager.\n(1/3)", "url": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzkq6tw42f"}, {"timestamp": "2026-10-21T08:52:54Z", "date_only": false, "value": "2026-10-21T08:52:54+00:00", "kind": "kev", "label": "Recorded", "source": "shadowserver", "record": "CVE-2026-76504", "field": "timestamps.recorded_at", "uuid": "93e45084-36dc-4eaf-87ea-c70bb207c18d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-21T09:04:18.254Z", "date_only": false, "value": "2026-10-21T09:04:18.254360Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/93e45084-36dc-4eaf-87ea-c70bb207c18d", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "f032dcf6-8b24-4df8-9e16-c241d886eaac", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/93e45084-36dc-4eaf-87ea-c70bb207c18d"}, {"timestamp": "2026-10-23T02:06:37Z", "date_only": false, "value": "2026-10-23T02:06:37.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/106685", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "f8c0d9c2-341d-4b3e-936a-cec5d4321da5", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Nuclei #template #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-76504-nuclei\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a pastelghost3\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-23 02:00:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNuclei template for CVE-2026-76504 \u2014 Cisco vManage authentication bypass\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/106685"}, {"timestamp": "2026-10-23T02:06:37Z", "date_only": false, "value": "2026-10-23T02:06:37.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/106685", "record": "CVE-2026-76504", "field": "creation_timestamp", "uuid": "d4a143c4-252f-4650-9ab9-eb0a659ebd63", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Nuclei #template #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-76504-nuclei\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a pastelghost3\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-23 02:00:53\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNuclei template for CVE-2026-76504 \u2014 Cisco vManage authentication bypass\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/106685"}]}