cyber.hendryadrian.com
Vulnerability & Exploit · helpnetsecurity.com

Cisco SD-WAN Manager Zero-Day Exploited in Attacks; Fixes Released

· Original article ↗

Summary

Cisco says attackers are exploiting an authentication bypass in Catalyst SD-WAN Manager that can grant admin-level API access. Fixes are available, and CISA has ordered US federal agencies to remediate by October 3, 2026.

Key points

  • CVE-2026-76504 is an API authentication bypass caused by improper handling of URI encoding in HTTP requests.
  • The flaw affects Cisco Catalyst SD-WAN Manager releases 26.2, 26.1, 20.18, 20.15, 20.12, 20.9, and releases earlier than 20.9.
  • A crafted HTTP request could bypass authentication and provide access to the API as an admin user.
  • Cisco says it became aware of active exploitation in September 2026; it has not shared details about the attacks.
  • Fixed releases are available for versions 20.9 through 26.2. Systems running releases earlier than 20.9.10.1 should migrate to a fixed version; no workaround addresses the flaw.
  • Cisco advises restricting access from unsecured networks and checking logs or collecting device evidence to assess possible compromise.
  • CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and set an October 3, 2026 remediation deadline for US federal civilian agencies.

Article Details

Vulnerability Types
  • API authentication bypass caused by improper handling of URI encoding in an HTTP request
Affected Versions
  • Cisco Catalyst SD-WAN Manager 26.2
  • Cisco Catalyst SD-WAN Manager 26.1
  • Cisco Catalyst SD-WAN Manager 20.18
  • Cisco Catalyst SD-WAN Manager 20.15
  • Cisco Catalyst SD-WAN Manager 20.12
  • Cisco Catalyst SD-WAN Manager 20.9
  • Cisco Catalyst SD-WAN Manager releases earlier than 20.9
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • For on-premises deployments, restrict access from unsecured networks, such as the internet. If internet access is required, restrict access to known, trusted hosts on ports and protocols included in the user guides.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationAttackers exploited the authentication-bypass vulnerability by sending a crafted HTTP request to the Cisco Catalyst SD-WAN Manager API.

CVE

CVE-2026-76504Cisco has disclosed that attackers are exploiting CVE-2026-76504 in zero-day attacks against Cisco Catalyst SD-WAN Manager, an API authentication bypass that can let an attacker gain admin-level access to the network

Vendors

CiscoCisco has disclosed that attackers are exploiting CVE-2026-76504 in zero-day attacks against Cisco Catalyst SD-WAN Manager, an API authentication bypass that can let an attacker gain admin-level access to the network

Products

Cisco Catalyst SD-WAN ManagerCisco has disclosed that attackers are exploiting CVE-2026-76504 in zero-day attacks against Cisco Catalyst SD-WAN Manager, an API authentication bypass that can let an attacker gain admin-level access to the network

Related Articles