Published: 10/01/26
Thursday opens on a WAN control-plane clock. Cisco confirmed active exploitation of an auth bypass in Catalyst SD-WAN Manager, and CISA’s federal due date is Saturday. Also on the desk: TeamViewer’s “update now” client pack, an OpenSSL DTLS heap leak for anyone shipping UDP TLS, and a MikroTik web-management bug that can root a router with one request.
Lead Story
Your SD-WAN Manager has a Saturday deadline — and attackers already have admin
CVE-2026-76504 lets an unauthenticated attacker reach the Catalyst SD-WAN Manager API as admin via a URI-encoding trick. Cisco became aware of exploitation in September. Fixed builds are out; there is no software workaround. Collect admin-tech, upgrade, then hunt %6a / j_security_check in the NMS logs.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Why it matters: Admin on the Manager is admin across the WAN edges it configures.
Also Worth Your Attention
TeamViewer told every desktop owner to update
Five high-severity Full Client and Host flaws, led by a session access-control bypass that can lead to remote code execution. Move to 15.82 (and supported maintenance lines). No known exploitation yet — still patch this week.
Why it matters: Helpdesk remote-access agents are how ransomware operators finish the job.
OpenSSL’s DTLS fix for calls and WebRTC
A high-severity handshake resend bug can leak heap memory or crash the process on DTLS paths. Public fixes: 4.0.3 / 3.6.5 / 3.5.9 / 3.4.8. OpenSSL 3.0 needs a distro backport or a branch upgrade.
Why it matters: Only DTLS users are exposed — but those stacks rarely sit in the regular TLS patch ring.
MikroTik web management can be rooted with one request
CISA flagged a pre-auth integer underflow in RouterOS HTTP body handling. Pull WWW/WinBox off the internet and move to 7.23+ / 7.24.x.
Why it matters: Branch routers with open management are still a favorite botnet door.
Cisco SD-WAN Manager → fixed build by Sat Oct 3 + hunt NMS logs; TeamViewer → 15.82; OpenSSL DTLS → 4.0.3/3.6.5/3.5.9/3.4.8 or distro package; MikroTik → management off internet + RouterOS 7.23+/7.24.x.
Go Deeper
Identity & access: IAM library · Tools & playbooks: Cybersecurity Tools · Subscribe: Daily Brief
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
