Cisco Catalyst SD-WAN Manager zero-day exploited and added to CISA's KEV: what to check today if your Mexico sites connect through Cisco SD-WAN

On September 30 Cisco warned about a critical flaw in Catalyst SD-WAN Manager, the console formerly known as vManage: an authentication bypass already being used in real attacks, as BleepingComputer reported. An authentication bypass is exactly what it sounds like: getting in without a password. The next day, October 1, CISA added it to its KEV catalog, the list of flaws with confirmed exploitation that US agencies must patch on a deadline, according to The Hacker News.

If your company connects a plant in Querétaro, a warehouse in Monterrey and an office in Mexico City through Cisco SD-WAN, this is for you. If you manage that network from Houston, Toronto or Madrid, even more so.

What the SD-WAN Manager is and why it is the crown jewel

SD-WAN bundles several internet links (fiber, a dedicated circuit, even LTE or Starlink) and turns them into one private network across sites. The Manager is the console where everything is administered: configuration templates, traffic policies, the certificates of each router and the users allowed to touch the network.

Nobody at the Mexico plant configures anything by hand. The router arrives, phones home to the Manager and gets its instructions. That convenience becomes the problem when someone walks in uninvited.

Why a bypass there hands over every site

With admin access to the Manager, an attacker never has to set foot in a branch. From the console they can:

What they can do	What it means for you
Change traffic policies	Route plant data wherever they want
Push new templates to the routers	Open doors in every site at once
Create users and certificates	Stay inside even after you patch
Disable security rules	Leave the network blind

In our experience, what worries a foreign headquarters most is that the Mexico sites have the fewest eyes on them. An intruder in the Manager has the map, the keys and the remote control, and the first symptom may show up in a plant two time zones away from you.

How to tell if your console is exposed to the internet

The simplest test: can the Manager login page be opened from outside the company network? Have someone try from a phone on mobile data, no VPN. If the login page loads, it is exposed. Then check which firewall rule allows it and from where.

The right setup is a Manager that only answers from the management network or through the corporate VPN. If it was published so the US team could log in without VPN, that convenience ends today.

How to look for signs of intrusion

Go through the Manager audit log for the last few weeks and look for:

• New admin users nobody remembers creating.
• Logins from IP addresses that are not yours or your provider’s.
• Templates or policies changed outside your change windows.
• Certificates issued or routers added without a work order.

Export those logs off the box before upgrading. If anything looks off, rotate every admin password and key and get help before touching more.

Patching without dropping the links

The good news: branch routers keep forwarding traffic even if the console is offline for a while. What you lose during the upgrade is the ability to push changes and see monitoring. So the patch can go in a planned window without stopping the plant.

1. Back up the configuration and, if the Manager is virtual, take a snapshot.
2. Confirm the new release is compatible with your controllers and routers.
3. Tell the Mexico sites about the window: links stay up, but nobody requests changes.
4. Upgrade and verify every router comes back green.
5. Rotate credentials and confirm the console is no longer published.

Let's talk

And in your Mexico operation?

If two or more of your Mexico sites connect through Cisco SD-WAN, there are three questions today: is the console exposed, which version runs, and has anyone already been inside? If you cannot answer them before lunch in your time zone, you need a hand.

At ProcessBi we review the perimeter, coordinate the patch with your team wherever it sits, and put technicians on site in any Mexican city if a branch router does not come back after the upgrade. Invoicing in MXN or USD.

Book your free perimeter review — we reply the same business day.