The Guyana National Computer Incident Response Team (CIRT) issued an advisory on October 1st about an authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager. CVE-2026-76504 allows a remote attacker without login credentials to gain administrator access through the system’s API.
Cisco disclosed the vulnerability on September 30 and confirmed that it became aware of active exploitation during September. The precise start of the attacks and the number of affected organizations remain undisclosed.
Cisco confirmed that there is no workaround to address this vulnerability. It has issued fixes and says software upgrades are required for remediation. Its October 2 update introduced a temporary shield offering only partial protections. Its Cisco-managed cloud service has already been fixed, with no customer action required. Guyana’s CIRT team advises users and administrators to review the update and apply it where necessary. Caribbean organizations should establish whether they or their network provider use the affected Manager.
Leadership should check with the network owner or provider on the following:
Which deployment supports the organization
Is the applicable fix is in place
Has suspicious access has been assessed
Where a provider manages the platform, the organization still needs evidence that its own service has been covered.
TAKEAWAY: Ask your network owner or provider to confirm the deployment type, remediation status, and findings from its review of suspicious access.
WHY THIS MATTERS: For Caribbean organizations using the affected platform, unauthorized access to network management could threaten the connectivity on which operations depend.
