--- title: "Security digest: September 30, 2026" url: https://erroneo.us/security/2026-09-30/ description: "September 30, 2026 vulnerability digest: 2 briefs (Cisco SD-WAN Manager CVE-2026-76504: Exploited…); 1 CISA KEV addition (Cisco); 1 critical advisory (npm).…" type: security-digest-day section: "Security Digest" date_published: 2026-09-30 date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: September 30, 2026 2 editorial briefs, 1 known exploited (cisa kev) addition and 1 critical advisory. ## Take stock - Act now: Cisco SD-WAN Manager CVE-2026-76504: Exploited Auth Bypass . Every organization running Cisco Catalyst SD-WAN Manager (vManage) on-prem or in a self-managed cloud, on any configuration, below the first fixed release for its train. - Act now: Zammad CVE-2026-102489/102490: Exploited RCE-to-Root Chain . Anyone self-hosting Zammad 6.3.0-6.5.4 (remote code execution), and anyone running Zammad from the DEB or RPM packages below 7.2.2 (local root escalation that completes the chain). - Do you run any of these? Cisco Catalyst SD-WAN Manager. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-10-03. - npm: 1 critical advisory ( next ). Check with npm audit (or: npm ls ) . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Editorial briefs - **Act now** [Cisco SD-WAN Manager CVE-2026-76504: Exploited Auth Bypass](https://erroneo.us/security/briefs/cisco-sd-wan-manager-cve-2026-76504-api-auth-bypass/index.md): If you run SD-WAN Manager on-prem, upgrade now and check the logs Cisco names; one crafted HTTP request gives an unauthenticated attacker admin over the controller for your whole WAN. - **Act now** [Zammad CVE-2026-102489/102490: Exploited RCE-to-Root Chain](https://erroneo.us/security/briefs/zammad-cve-2026-102489-102490-rce-root-chain/index.md): Self-hosted Zammad on 6.x is remotely exploitable and was used in a real breach: upgrade to 7.2.2 today (6.5.5 only as a stopgap), and patch DEB/RPM installs of any version to close the root escalation. ## Known exploited (CISA KEV) - [CVE-2026-76504](https://erroneo.us/security/cve/CVE-2026-76504/index.md) Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability (CISA due 2026-10-03) ## Critical advisories - [GHSA-vcvr-r3jv-pc5j](https://erroneo.us/security/ghsa/GHSA-vcvr-r3jv-pc5j/index.md) Next.js: Remote Code Execution in next/og ImageResponse — npm next >= 16.2.0, < 16.3.6 → 16.3.6 --- Source page: https://erroneo.us/security/2026-09-30/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt