Thursday’s brief: SD-WAN admin bypass due Saturday, then TeamViewer, OpenSSL, MikroTik

Published: 10/01/26

Thursday opens on a WAN control-plane clock. Cisco confirmed active exploitation of an auth bypass in Catalyst SD-WAN Manager, and CISA’s federal due date is Saturday. Also on the desk: TeamViewer’s “update now” client pack, an OpenSSL DTLS heap leak for anyone shipping UDP TLS, and a MikroTik web-management bug that can root a router with one request.

Lead Story

Your SD-WAN Manager has a Saturday deadline — and attackers already have admin

CVE-2026-76504 lets an unauthenticated attacker reach the Catalyst SD-WAN Manager API as admin via a URI-encoding trick. Cisco became aware of exploitation in September. Fixed builds are out; there is no software workaround. Collect admin-tech, upgrade, then hunt %6a / j_security_check in the NMS logs.

Why it matters: Admin on the Manager is admin across the WAN edges it configures.

See the patch list →

Also Worth Your Attention

TeamViewer told every desktop owner to update

Five high-severity Full Client and Host flaws, led by a session access-control bypass that can lead to remote code execution. Move to 15.82 (and supported maintenance lines). No known exploitation yet — still patch this week.

Why it matters: Helpdesk remote-access agents are how ransomware operators finish the job.

See the update path →

OpenSSL’s DTLS fix for calls and WebRTC

A high-severity handshake resend bug can leak heap memory or crash the process on DTLS paths. Public fixes: 4.0.3 / 3.6.5 / 3.5.9 / 3.4.8. OpenSSL 3.0 needs a distro backport or a branch upgrade.

Why it matters: Only DTLS users are exposed — but those stacks rarely sit in the regular TLS patch ring.

Check your OpenSSL branch →

MikroTik web management can be rooted with one request

CISA flagged a pre-auth integer underflow in RouterOS HTTP body handling. Pull WWW/WinBox off the internet and move to 7.23+ / 7.24.x.

Why it matters: Branch routers with open management are still a favorite botnet door.

See the exposure checklist →

Cisco SD-WAN Manager → fixed build by Sat Oct 3 + hunt NMS logs; TeamViewer → 15.82; OpenSSL DTLS → 4.0.3/3.6.5/3.5.9/3.4.8 or distro package; MikroTik → management off internet + RouterOS 7.23+/7.24.x.

Go Deeper

Identity & access: IAM library · Tools & playbooks: Cybersecurity Tools · Subscribe: Daily Brief

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].