Cisco Confirms Active Exploitation of Critical SD-WAN Manager Flaw

Summary

Cisco says attackers are exploiting CVE-2026-76504, a critical authentication bypass in Cisco Catalyst SD-WAN Manager that can grant administrator-level API access. On-premises users should apply the update; Cisco-managed cloud users have received the fix.

Key points

Cisco disclosed CVE-2026-76504 on September 30, 2026, and reported exploitation in the wild.
The flaw affects authentication for a specific API endpoint and stems from improper handling of URL-encoded characters.
A remote attacker can send a crafted HTTP request to bypass authentication and gain administrator-level API access without credentials or user interaction.
Internet-exposed SD-WAN Manager deployments face particular risk because the platform centrally manages network policies, devices, and connectivity.
On-premises customers should install the relevant software update; Cisco says its managed SD-WAN Cloud service has already been fixed.
Cisco recommends restricting administrative access to trusted networks and checking specified logs for encoded j_security_check paths and usernames beginning with viptela-reserved-.

Article Details

Vulnerability Types: Authentication bypass caused by improper handling of URL-encoded characters
Severity: Critical; CVSS v3.1 score 9.8
Exploitation Status: active
Exploit Availability: unknown
Patch Status: available
Workarounds: Limit access to SD-WAN Manager administrative interfaces to trusted management networks and approved administrative hosts while upgrades are evaluated or deployed.