Cisco Warns of Active Exploitation of Critical SD-WAN Manager Zero-Day

Summary

Cisco says attackers are exploiting CVE-2026-76504, a critical authentication bypass in SD-WAN Manager that can grant unauthenticated admin API access. Fixed releases are available; Cisco advises restricting access, upgrading, and checking logs.

Key points

CVE-2026-76504 is a CVSS 9.8 zero-day affecting Cisco Catalyst SD-WAN Manager; Cisco says it is actively exploited.
A remote attacker needs no credentials and can exploit URI-encoding mishandling in an HTTP request to bypass authentication and access the API as admin.
Cisco has released fixed versions for affected release trains; no workaround is available. Cisco Managed SD-WAN Cloud is already fixed.
Until upgraded, customers should restrict Manager access from unsecured networks and allow access only from known, trusted hosts where internet access is required.
Cisco advises checking logs for suspicious j_security_check activity, including URI-encoded variants, while validating matches against normal activity.
Cisco did not disclose the number of victims, attack timeline, attackers, or whether upgrading removes access already gained.

Article Details

Vulnerability Types: Authentication bypass caused by mishandling URI encoding in an HTTP request
Severity: Critical; CVSS 9.8
Exploitation Status: active
Exploit Availability: unknown
Patch Status: available
Workarounds: Restrict access from unsecured networks, including the internet; where internet access is required, allow only known, trusted hosts and place control components behind a firewall.