Retrospective for 2026-10-01, compiled on 27 October 2026. The date identifies the day being analysed; source publication and revision dates are recorded below.
What this advisory changes in your environment
The starting point is CERTFR-2026-AVI-1246, published on 2026-10-01. Its scope includes Catalyst SD-WAN Software. Reported consequences are security control bypass. These statements apply to the advisory’s scope; they do not assign every consequence to every product or CVE.
This case focuses on Catalyst SD-WAN Software. Locate that edition in live installations, deployment images and actual dependencies, rather than treating every product from Cisco as equivalent.
Products and versions to examine
- Reference
- CERTFR-2026-AVI-1246
- Source first published
- 2026-10-01
- Latest source revision available for this day
- 2026-10-01
- Named components
- Catalyst SD-WAN Software
- CVE identifiers
- CVE-2026-76504
| Component | Published condition |
|---|---|
| Catalyst SD-WAN Software | 20.12.x : < 20.12.8.2 |
| Catalyst SD-WAN Software | 26.2.x : < 26.2.1 |
| Catalyst SD-WAN Software | 26.1.x : < 26.1.2.1 |
| Catalyst SD-WAN Software | 20.18.x : < 20.18.4.1 |
| Catalyst SD-WAN Software | 20.15.x : < 20.15.6.1 |
For Catalyst SD-WAN Software, the published condition is “20.12.x : < 20.12.8.2”. Compare the version actually loaded with that condition within its own release branch. A fix installed on another edition of Catalyst SD-WAN Software does not close this case.
Mechanism and prerequisites
A security bypass challenges a trust boundary. Verify server-side authorisation decisions and alternative paths; hiding an interface is not an access restriction.
For CERTFR-2026-AVI-1246, the retained documents do not provide a suitably dated primary CVE record to establish this case’s prerequisites. Required authentication, user interaction and active exploitation therefore remain unestablished here; they are not inferred from Catalyst SD-WAN Software or the risk category alone.
Choose the appropriate intervention
- Locate Catalyst SD-WAN Software instances, running releases and service owners. Record condition 20.12.x : < 20.12.8.2 in the ticket alongside reference CERTFR-2026-AVI-1246.
- Compare the installed branch with the vendor’s Catalyst SD-WAN Software release notes. Prepare the package for that branch and a dependent-service test, retaining the pre-change state.
- After changing Catalyst SD-WAN Software, capture the loaded version again and verify the workflow below. Any exception needs an owner, an exposure-reduction measure and an expiry date.
Verify the fix in a real workflow
Validation scenario to adapt for Catalyst SD-WAN Software: For Catalyst SD-WAN Software, test an authorised business flow from each zone reaching the service and confirm management restrictions. If a redundant pair exists, verify both nodes and rule persistence after failover during a planned maintenance window. This is a proposed defensive check, not a claim that testing was performed against third-party systems.
Limit of case CERTFR-2026-AVI-1246: this analysis replaces neither vendor prerequisites nor investigation of your logs. Only documented versions are reproduced; no attack date or victim is invented.
Questions specific to this case
Which condition should be checked for Catalyst SD-WAN Software?
Advisory CERTFR-2026-AVI-1246 states: Catalyst SD-WAN Software — 20.12.x : < 20.12.8.2. Check the edition and running release; do not extend the published boundary to branches absent from the advisory.
What is still needed to assess Catalyst SD-WAN Software exposure?
For Catalyst SD-WAN Software, establish the running version, the path to the component and process permissions. The sources retained for CERTFR-2026-AVI-1246 do not establish every prerequisite or active exploitation.
Sources and related reading
Practical guide : Software inventory: prepare for end of support
Explore the decision addressed in this case
- NetExtender Linux Client: restore access controls
- NetScaler ADC, NetScaler Gateway: restore access controls
Complete source advisory inventory
The article table may be an extract. These lists contain every affected-system entry and CVE in the specified advisory revision. They are not an inventory of your assets and do not map every CVE to every product.
Official source · CERTFR-2026-AVI-1246
Advisory revision : · Checked on :
Affected systems · 6
Original French wording is retained to avoid ambiguous translations of version conditions.
- Catalyst SD-WAN Software versions postérieures à Earlier than 20.9 et antérieures à 20.9.10.1
- Catalyst SD-WAN Software versions 20.12.x antérieures à 20.12.8.2
- Catalyst SD-WAN Software versions 26.2.x antérieures à 26.2.1
- Catalyst SD-WAN Software versions 26.1.x antérieures à 26.1.2.1
- Catalyst SD-WAN Software versions 20.18.x antérieures à 20.18.4.1
- Catalyst SD-WAN Software versions 20.15.x antérieures à 20.15.6.1