The federal clock is the news here. CISA added Cisco's Catalyst SD-WAN Manager bypass to its Known Exploited Vulnerabilities catalog and gave agencies until October 3 to patch or pull it offline. The flaw — CVE-2026-76504, a CVSS 9.8 — lets an unauthenticated attacker reach the manager's API with admin rights, because it mishandles URI encoding in requests and a crafted path slips past the auth rule. There's no workaround; the fix is an upgrade, and fixed builds now exist across every affected release train. Running a customer-managed instance? Treat this as an emergency change, not next month's maintenance window.