Act now:Cisco SD-WAN Manager CVE-2026-76504: Exploited Auth Bypass. Every organization running Cisco Catalyst SD-WAN Manager (vManage) on-prem or in a self-managed cloud, on any configuration, below the first fixed release for its train.
Act now:Zammad CVE-2026-102489/102490: Exploited RCE-to-Root Chain. Anyone self-hosting Zammad 6.3.0-6.5.4 (remote code execution), and anyone running Zammad from the DEB or RPM packages below 7.2.2 (local root escalation that completes the chain).
Do you run any of these? Cisco Catalyst SD-WAN Manager. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-10-03.
npm: 1 critical advisory (next). Check with npm audit (or: npm ls <package>).
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
If you run SD-WAN Manager on-prem, upgrade now and check the logs Cisco names; one crafted HTTP request gives an unauthenticated attacker admin over the controller for your whole WAN.
Must act: Every organization running Cisco Catalyst SD-WAN Manager (vManage) on-prem or in a self-managed cloud, on any configuration, below the first fixed release for its train.
Can relax: Customers on Cisco-managed SD-WAN Cloud (fixed in 20.15.605, no action needed) and organizations that don't use Catalyst SD-WAN.
Identify every SD-WAN Manager instance and its release.
Upgrade to the first fixed release for your train (20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 or 26.2.1); migrate off anything older than 20.9.
Block access to the Manager's web and API interfaces from the internet and other untrusted networks, per Cisco's SD-WAN hardening guide.
Self-hosted Zammad on 6.x is remotely exploitable and was used in a real breach: upgrade to 7.2.2 today (6.5.5 only as a stopgap), and patch DEB/RPM installs of any version to close the root escalation.
Must act: Anyone self-hosting Zammad 6.3.0-6.5.4 (remote code execution), and anyone running Zammad from the DEB or RPM packages below 7.2.2 (local root escalation that completes the chain).
Can relax: Zammad SaaS customers, and self-hosted 7.x installs running from source or the official container images, which neither bug can be used against as published.
Find every self-hosted Zammad and its version and install type (dpkg -l zammad, rpm -q zammad, or the container image tag).
Upgrade to Zammad 7.2.2; if you are stuck on 6.5, install 6.5.5 today and plan the move to 7.2.2.
If you cannot upgrade a 6.x instance now, take it offline or put it behind a VPN, as DIVD advises.