CISA adds exploited Cisco SD-WAN Manager flaw to its priority catalog

CISA has added CVE-2026-76504, a Cisco Catalyst SD-WAN Manager hex-encoding vulnerability, to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation. The listing establishes that attackers are using the flaw. CISA does not identify affected versions, victims, the number of systems involved or how hex encoding is abused in an attack.

CISA says vulnerabilities of this type are a frequent attack vector for malicious actors and pose significant risks to the federal enterprise. That raises the flaw's remediation priority, but it does not prove that any particular network was breached.

What the federal directive requires

Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of high-risk, cataloged vulnerabilities on publicly exposed assets when exploitation would give an attacker total control. It also sets basic expectations for checking whether an attacker compromised a system before a patch was applied.

The directive applies only to Federal Civilian Executive Branch agencies. CISA encourages all organizations to use risk-based vulnerability management and prioritize remediation of vulnerabilities in the Known Exploited Vulnerabilities Catalog.