CVE-2026-76504 is an authentication bypass in Cisco Catalyst SD-WAN Manager. Attackers were using it to escalate to administrator privileges before Cisco shipped a fix. Heise's headline for the same advisory reads "Patch now", which is what a vendor's advisory says when the first customers to learn of the flaw were the ones being attacked.

SD-WAN Manager is the console that holds the configuration for the wide-area network a bank's branches and data centres run over. An administrator login on it is an administrator login on the thing that decides where traffic goes.

Cisco has called the flaw critical and confirmed active exploitation. The reporting I can see does not say how many customers were hit, who was behind it, or how long the bug was live before the patch. Anyone attributing it today is guessing.

Cisco's other authentication bypass this month is CVE-2026-76460, in Identity Services Engine, the product that decides which devices and users get onto the network. It carries a CVSS score of 10 and went onto CISA's Known Exploited Vulnerabilities list on 16 September.

That is two Cisco products, one failure class, inside a fortnight. One of them decides who gets in. The other decides where the traffic goes after.

A management plane that cannot be reached from the internet would have changed this outcome, because a login bypass needs a login page to bypass. The sources do not say whether the exploited instances were exposed, so nobody outside Cisco and the victims can yet say whether that control was absent.