Cisco has patched CVE-2026-76504 (Cisco advisory cisco-sa-sdwan-webauth-xr8beuuU), a critical authentication bypass in the API of Cisco Catalyst SD-WAN Manager (formerly vManage). An unauthenticated, remote attacker can use it to get into the system with admin user privileges. Cisco published the advisory on 30 September 2026 and says it became aware of active exploitation that same month. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog the same day, with a federal remediation deadline of 3 October. That deadline has passed. Any internet-reachable SD-WAN Manager that was not patched promptly should now be checked for compromise as well as patched.
Technical Information
- Root cause: the API's session-based authentication mishandles URI encoding (CWE-177). A crafted HTTP request with an encoded character can slip past an authentication rule meant to protect a specific API endpoint. The result is API access as the admin user.
- Severity: CVSS 3.1 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). This score comes from Cisco. NVD lists Cisco's score and has not published its own.
- Scope: Cisco says the flaw affects SD-WAN Manager "regardless of system configuration". Systems with management ports exposed to the internet are most at risk.
- Exploitation: Cisco found the flaw while resolving a Technical Assistance Center (TAC) case. Its PSIRT became aware of active exploitation in September 2026. Cisco has not attributed the activity to any actor. CISA lists ransomware use as "Unknown".
- Not the same bug: Rapid7 notes that two earlier 2026 Catalyst SD-WAN flaws were separate peering-authentication issues (Rescana covered one of them in this advisory). CVE-2026-76504 is a different API authentication path.
- KEV entry: "Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability", dateAdded 2026-09-30, dueDate 2026-10-03, forensicTriage Yes.
Affected Product Versions
| Catalyst SD-WAN release | First fixed release |
|---|---|
| Earlier than 20.9 | Migrate to a fixed release |
| 20.9 | 20.9.10.1 |
| 20.12 | 20.12.8.2 |
| 20.15 | 20.15.6.1 |
| 20.18 | 20.18.4.1 |
| 26.1 | 26.1.2.1 |
| 26.2 | 26.2.1 |
| SD-WAN Cloud (Cisco Managed) | Fixed in 20.15.605; Cisco says no customer action is needed |
Workaround and Mitigation
- Upgrade to the first fixed release for your train. Cisco says there are no workarounds.
- Restrict management access on on-premises deployments. Block access from the internet and other untrusted networks, allow only known, trusted hosts, and put SD-WAN control components behind a filtering device (see Cisco's SD-WAN Hardening Guide). Cisco has already applied this mitigation to Cloud Hosted environments.
- Temporary shield: Cisco's Live Protect shield gives only partial, temporary protection. It may also stop legitimate users who use URI encoding from logging in. It is not a substitute for upgrading.
- Detect: deploy Snort rule 67179.
- Check for compromise: if you need help, open a Cisco TAC case at Severity 3 with "CVE-2026-76504" in the title, and attach the output of request admin-tech.
Indicators of Compromise
Cisco has published log-based indicators. It has not published IPs or hashes.
| Log file | What to look for |
|---|---|
| /var/log/nms/containers/service-proxy/serviceproxy-access.log | Requests to j_security_check in which a character of the path is URI-encoded, from unknown or unauthorized IP addresses. Cisco notes that encoding any single character can trigger the flaw. |
| /var/log/nms/vmanage-server.log | j_security_check entries for usernames starting with viptela-reserved-, from unknown or unauthorized IP addresses |
Cisco cautions that these entries can also appear during normal operations, so compare them with your usual network activity before you conclude a system is compromised. No MITRE ATT&CK mapping has been published.
Sources
- Cisco security advisory cisco-sa-sdwan-webauth-xr8beuuU
- Rapid7 ETR on the exploited SD-WAN Manager API authentication bypass
- NVD entry for CVE-2026-76504
What This Means for Your Third-Party Risk Program
SD-WAN Manager is the control plane for an organization's wide-area network. Admin access to its API means an attacker can change how branch sites connect. The third parties that matter here are the carriers and managed service providers that run SD-WAN on your behalf, and the suppliers whose networks your connectivity depends on. A fast but accurate review targets those few suppliers rather than everyone who owns Cisco equipment. Ask them:
- Do you run Cisco Catalyst SD-WAN Manager for our network or your own, and is it on-premises or Cisco-hosted?
- Is it on a fixed release listed in Cisco's advisory?
- Is its management interface reachable from the internet, and who can reach it?
- Since September, have you reviewed the logs Cisco highlights, or run a TAC compromise check?
Forward this to your TPRM owner: Cisco Catalyst SD-WAN Manager CVE-2026-76504 (Cisco CVSS 9.8) lets attackers bypass authentication and gain admin access. It has been exploited and is in CISA KEV, and the 3 October deadline has passed. Please confirm which carriers or MSPs run our SD-WAN, and send them the four questions above.
If you want to identify which carriers and MSPs run Catalyst SD-WAN Manager for you, and track their answers on patching and compromise checks, book a demo.
