Incident Responder: 2026-09-30

1. Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability

   Cisco, 2026-09-30. Read, 7 min.

   Cisco disclosed CVE-2026-76504 (CVSS 9.8), a flaw in the API authentication of Cisco Catalyst SD-WAN Manager that could let an unauthenticated, remote attacker access an affected system with the privileges of the admin user, and says its PSIRT became aware of active exploitation in September 2026. Fixed releases include 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1, and the Cisco-managed cloud release 20.15.605 needs no customer action.

   Why it matters for this role: Request an admin-tech file from SD-WAN Manager for Cisco TAC and audit serviceproxy-access.log and vmanage-server.log for j_security_check entries from addresses you do not recognize.

2. French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks

   The Hacker News, 2026-09-29. Read, 7 min.

   ANSSI's incident report on France's tax administration, the DGFIP, found that an attacker logged in to portals that asked only for a password, using staff passwords probably taken by infostealers from computers the DGFIP did not manage. Neither the DGFIP's SOC nor ANSSI's monitoring saw the data leave, and the theft became known only when the attacker claimed it on August 12.

   Why it matters for this role: When an account is reported compromised, review what it did from the likely date of compromise rather than from the alert, as ANSSI advises after the DGFIP case.

Incident Responder