This month's Cisco, OpenSSL and Spectre bugs landed below the layer your monitoring watches

Cisco's Catalyst SD-WAN Manager is the box companies use to run their SD-WAN networks, and CVE-2026-76504 lets a remote attacker with no login use its API as the admin user ^[1]. The flaw lives in the part of the API that handles login sessions. The Manager mishandles URI encoding in an HTTP request, so a crafted request slips past an authentication rule meant to lock down a single endpoint ^[2]. The attacker needs no credentials, only the ability to send that request, and by default the admin user holds the netadmin role, which can perform every operation on the device ^[3]. Cisco scored it 9.8 out of 10 ^[4]. Cisco said its product security team "became aware of active exploitation of this vulnerability" in September 2026 ^[5].

Finding it after the fact means reading the Manager's own logs. The signs Cisco published are j_security_check entries from unknown IP addresses in two files on the appliance; in the example one character of that login path is URI-encoded, giving /%6a_security_check, where %6a stands for j ^[6]. Those entries also show up during normal operation, so each match has to be checked by hand against normal activity, and the advisory does not include a detection rule ^[7]. If you are not already pulling and parsing the Manager's session logs, a network or application view will not show you an API auth bypass on the appliance that runs your network.

The OpenSSL and CPU disclosures have the same shape: the instruments point at the network and the application, while the failure sits a layer below.

The crypto library

OpenSSL's September 29 release fixes CVE-2026-84782, which can leak heap memory to the other side of a DTLS connection or crash the program ^[9]. DTLS is the TLS variant for UDP, and it resends a handshake message when no reply arrives before the timer expires; the leak happens when that resend fires while a larger handshake message is stuck part-way through being sent ^[10]. Before the fix, the resend used the paused message's position in the buffer instead of returning to the start of the message being resent ^[11]. The resent message went out with the wrong label, its body was leftover bytes from the larger message, and reading it could overrun the buffer ^[11]. That wrongly labeled message carries heap memory to the peer as unencrypted handshake data ^[12].

The leak is heap memory crossing the wire as handshake bytes an application never parses. OpenSSL rates it High, one level below Critical; CISA assigned CVSS 8.2 and listed exploitation as "none" at the time ^[13]. OpenSSL has not said whether an attacker can force a resend while a message is stuck, and reported no attacks ^[14]. DTLS protects WebRTC data channels and sets up keys for internet calls, and software is exposed only if it uses OpenSSL for DTLS ^[15]. Anyone who builds OpenSSL 3.0 themselves, or ships a copy inside their own product, has no public fix: OpenSSL stopped public 3.0 security fixes on September 7 ^[16].

The same window produced a second DTLS parsing bug one layer up. Citrix NetScaler's CVE-2026-88772, scored 9.5 and exploited in the wild, is a memory overflow in the appliance's DTLS handling that can be turned into arbitrary shellcode running as root ^[17].

The CPU

VUSec and Scuola Superiore Sant'Anna disclosed a new Spectre-v2 variant, Branch Target Reuse, that affects JIT engines in web browsers, language runtimes and the operating system kernel across multiple CPU vendors ^[18]. The researchers' stated insight is that "while modern CPUs restore architectural code coherence after self-modification, they do not necessarily invalidate stale indirect branch prediction entries," and that in JIT engines "these stale targets can outlive the original code and later be reused when the code cache is repopulated, yielding a transient execute-after-free primitive" ^[19]. The attacker trains a branch to a chunk, frees it, allocates a target chunk that reuses part of the same address, and triggers the branch again. The CPU then uses the stale branch target buffer entry and speculatively jumps to the old entry point ^[20].

As a proof of concept the team built two exploits against the Linux kernel that recover the root password hash within minutes from a fully patched Intel system with default protections enabled ^[21]. Treat the minutes as a claim about one target. BTR was tested against SpiderMonkey, GraalVM and the Linux kernel's cBPF JIT, all affected but with "markedly different exploitability characteristics and leakage rates" ^[22]. For the figure to transfer, an attacker has to run unprivileged code in a JIT engine on the target, the stale buffer entry has to survive the free, and the predictor has to pick it ^[23]. Cristiano Giuffrida called it "the first example of a practical in-place Spectre-v2 attack," one "using the very same indirect branch for both training and testing" ^[24].

The misprediction's results are discarded and the attacker reads the secret through cache timing, so nothing at the OS or application layer logs it ^[25].

The security appliance

watchTowr, which reverse-engineered the NetScaler bug, states the assumption plainly. A security appliance "exists to keep an organization secure by standing between its systems and threats," concentrating defense at a chokepoint every connection has to pass through ^[26]. "Hardened," watchTowr writes, means the vendor stripped the device down and locked it up, with "minimal running services, restricted shell access, a controlled update path, and defaults tuned for security," on the premise that it is "tougher to break into than a general-purpose server" ^[27].

The Bitget theft shows what happens when that premise fails. The exchange confirmed that attackers who stole $387.5 million exploited a zero-day in third-party security products ^[28]. SlowMist said, "A service running on one of Product A's nodes was affected by a zero-day vulnerability," after which the attacker read the environment variable holding the database password and connected to the database ^[29]. Mandiant's account is blunter: the threat actor "compromised network and security appliances and leveraged them to distribute malicious packages and gain control over the wallet job server" ^[30]. Bitget attributes the theft to North Korean threat actors, based on IP behavior and on-chain analysis ^[31].

Cisco's advisory does not say whether upgrading evicts an attacker who already has access, and its advisories for two earlier SD-WAN flaws said an update alone would not resolve a confirmed compromise ^[8]. The Bitget intrusion is the worked example: the attacker entered through a security appliance and took control of the wallet job server, two layers apart ^[28][30]. The monitoring that watches the application cannot see a URI-encoding trick on a management API, a mislabeled DTLS fragment carrying heap memory, or a stale branch predictor entry ^[2][12][25].