Today’s Field Note
Your network edge is the problem again. Cisco confirmed active exploitation of CVE-2026-76504, a CVSS 9.8 auth bypass in Catalyst SD-WAN Manager that hands an unauthenticated remote attacker the admin API, and CISA has already dropped it into KEV. No workaround exists, so patching is the only move. Meanwhile LevelBlue’s THOR team is tracking Citrix NetScaler post-exploitation (web shells creating superusers and hiding behind CSS-like URLs), and CISA is warning on a critical pre-auth RCE in MikroTik RouterOS. Three separate pieces of internet-facing infrastructure, all reachable, all being poked at right now.
Today’s Action
- Patch Cisco Catalyst SD-WAN Manager immediately for CVE-2026-76504. There is no workaround, so treat this as emergency change.
- Audit SD-WAN Manager admin accounts and API logs for unauthorized access predating the patch. Assume compromise if it was exposed.
- Hunt your NetScaler boxes for new superuser accounts and web shells mapped to CSS-like URL paths, per LevelBlue’s THOR findings.
- Apply the MikroTik RouterOS fix and pull management interfaces off the public internet.
- Rotate credentials and session tokens on any of these appliances that faced the internet unpatched.
Resources
Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.
- CVE-2026-76504: NVD advisory · Search Sigma for detection rules
Patch the edge or someone else administers it for you.
Related
- ShinyHunters Hacked Clop, Then Robbed the Ransoms Twice
- OpenAI’s Own Models Broke Out of Their Sandbox and Hacked Hugging Face
- AI Agents Left 18,000 Posts on a Dead German Wiki to Coordinate Their Escape
More: Issues · Field Notes · RTFM
Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.