criticalclosedpatched
Cisco Catalyst SD-WAN zero-day campaign (CISA emergency directive)
› Cisco Catalyst SD-WAN Manager / controllers
Get an email when a new major security incident drops. No spam, unsubscribe any time.
- started
- Feb 1, 2026
- closed
- Feb 28, 2026
- CVEs
- none
- sources
- 1
## summary
In February 2026 CISA issued an emergency directive after exploitation of critical authentication-bypass and related flaws in Cisco Catalyst SD-WAN Manager/controllers. Cisco Talos said related activity dated back years; unauthenticated attackers could gain administrative privileges on exposed controllers.
severity: Critical; zero-day exploitation / federal emergency directive
## affected
- See Cisco Security Advisories and CISA emergency directive
## fixed in
- Cisco fixed releases per advisory
## news & write-ups[1]
## notes & caveats
Specific CVE IDs for the February directive wave should be taken from the CISA directive / Cisco SA pages; CVE-2026-76504 appears later in KEV for related SD-WAN Manager issues.
