The bug is an API authentication bypass in Cisco Catalyst SD-WAN Manager: mishandle URL encoding in a crafted HTTP request and the system treats you as the admin user, no credentials required. Cisco's PSIRT says it spotted exploitation in the wild in September, and CISA added CVE-2026-76504 to its exploited-vulnerabilities list on September 30 with a remediation deadline of October 3. Unlike the FortiMail situation, fixed releases are already available, and there's no workaround — the flaw hits regardless of configuration, so patching is the only move. It's the second exploited edge-appliance auth bypass to hit a CISA deadline this week, landing right alongside the unpatched FortiMail file-write bug. If you run SD-WAN Manager anywhere reachable, assume the window for "we'll get to it" has closed.