Cisco SD-WAN Manager Bug Under Active Exploit, No Fix Yet

Cisco is warning customers that a high-severity bug in Catalyst SD-WAN Manager is being exploited in the wild. No patch is available yet.

The flaw carries a CVSS of 7.8. That's not a perfect 10, but the exploitation status moves it up the triage list considerably.

The affected deployment matrix is broad. It covers on-prem installations, the Cloud-Pro tier, the Cisco-managed SD-WAN cloud offering, and SD-WAN for Government — the FedRAMP-authorized variant. If you run vManage in any of those modes, assume you're in scope until Cisco's advisory says otherwise.

SD-WAN Manager is the control plane for Cisco's software-defined WAN fabric. It pushes policy, manages certificates, and handles device onboarding across the overlay. A foothold there is not a foothold on one box. It's a foothold on the routing posture of the entire enterprise WAN.

Cisco hasn't published technical specifics beyond the CVSS vector and the deployment list. The vendor typically withholds exploit detail until a fixed train ships, which is the right call when active exploitation is confirmed and mitigations are thin.

A word on what this is and isn't. The CVSS 7.8 vector usually implies local access with low complexity and high impact across confidentiality, integrity, and availability. If that holds here, an attacker likely needs some prior authenticated access — perhaps a low-privilege operator account — and then escalates. That makes this an authorization (authz) failure layered on top of authentication (authn) that already succeeded.

Which brings us to the unfun honesty section: MFA on the vManage login would not have prevented this. The attacker is already past the front door. What would have helped is tighter RBAC scoping, a separate admin plane network, and aggressive session-token rotation on the management UI so a stolen cookie doesn't outlive its welcome.

Until Cisco ships fixed builds, the defensive playbook is unglamorous. Restrict management-plane access to a jump-host VLAN or bastion. Audit operator accounts and yank anything stale. Pull logs for unusual API calls against the vManage REST endpoints, particularly around device templates and policy pushes. If you can tolerate it, take FedRAMP deployments offline from general operator access and gate them behind a break-glass workflow.

If you're running the Cisco-managed cloud tier, the patching timeline is Cisco's problem. The monitoring is still yours.

Watch Cisco's PSIRT advisory page for the fixed-release schedule. Given the active-exploitation tag, expect an out-of-band update rather than a wait for the next quarterly bundle.

This one is worth interrupting your sprint for.