#Auth Bypass — insecure by design

critical3 sourcesCVE-2026-76504

In-the-Wild Exploitation Targets Cisco Catalyst SD-WAN via Critical URL-Encoding Auth Bypass

Cisco has released emergency updates to patch a critical authentication bypass flaw affecting Catalyst SD-WAN Manager, tracked as CVE-2026-76504 with a maximum CVSS v3.1 score of 9.8. The vulnerability is classified under CWE-177 and stems from improper handling of URI-encoded characters during session-based API authentication processing. By issuing a crafted HTTP request with encoded paths—such as swapping a standard character for `%6a` targeting the `j_security_check` endpoint—an unauthenticated remote attacker can bypass authentication controls. Successful exploitation grants the attacker full administrative access to the underlying management API without requiring valid credentials or user interaction. Cisco discovered the issue in September 2026 after active exploitation was identified during a Technical Assistance Center support engagement. All Catalyst SD-WAN Manager deployments are affected regardless of their system configuration, and no functional workarounds exist to mitigate the flaw. While Cisco-managed cloud instances received automatic mitigations, on-premises administrators must upgrade to fixed releases, including versions 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1. CISA responded by adding CVE-2026-76504 to its Known Exploited Vulnerabilities catalog, ordering US federal civilian agencies to remediate and assess their environments within a three-day window. Defenders are urged to examine `/var/log/nms/containers/service-proxy/serviceproxy-access.log` for anomalous requests directed at `j_security_check` and inspect `/var/log/nms/vmanage-server.log` for unexpected sessions originating from accounts prefixed with `viptela-reserved-`. Pending patches, network teams should sever direct internet exposure of the management console and restrict inbound access exclusively to verified, trusted IP addresses.

critical1 sourceCVE-2026-77537 CVE-2026-77545 +3

Ubiquiti Patches 22 Vulnerabilities Across UniFi Ecosystem, Including Three Max-Severity Flaws

Ubiquiti released a major security advisory addressing 22 vulnerabilities across nearly its entire product stack. The impacted software includes UniFi Protect, UniFi Network, UniFi Access, UniFi Talk, UniFi Connect, and the core UniFi OS platform. Out of the 22 addressed flaws, 21 carry a critical severity rating, with three vulnerabilities scoring a maximum CVSS rating of 10.0. Specifically, CVE-2026-77537 enables unauthenticated network attackers to execute arbitrary commands on the UniFi Protect host due to poor input validation. A related unauthenticated command injection bug, tracked as CVE-2026-77554, affects the UniFi Talk application. For the underlying operating platform, CVE-2026-77550 allows attackers to bypass authentication on UniFi OS instances via improper neutralization of CRLF sequences. Another notable vulnerability, CVE-2026-77545, carries a 9.0 CVSS score and stems from leftover active debugging code in UniFi OS. Additionally, CVE-2026-77549 presents another authentication bypass condition linked to CRLF handling. Ubiquiti indicated that these bugs are easily exploitable across local or remote networks without user interaction, though active in-the-wild exploitation was not confirmed prior to patch publication. Fixed software releases have been deployed across all affected product lines, requiring administrators to update to versions such as UniFi Network Application 10.5.67 and UniFi OS Server 5.1.37.