Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-76504 – Authentication Bypass – Cisco Catalyst SD-WAN Manager (versions earlier than 20.9,

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-76504 is a critical authentication bypass vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager. An unauthenticated, remote attacker can send a specially crafted HTTP request to the product’s API and obtain access with the privileges of the admin user. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and is confirmed by Cisco to be under active exploitation.

Technical details

  • Root cause: Improper handling of URI encoding in an HTTP request (CWE-177) allows a request to bypass an authentication rule that is intended to restrict access to a specific API endpoint.
  • Trigger conditions: An attacker sends a crafted HTTP request to the SD-WAN Manager API in which a character (e.g., the letter "j") is substituted with its URI hex-encoded form (e.g., %6a), causing the authentication filter to fail to recognize and block the request.
  • Attack vector: Network-based, requires no authentication, no privileges, and no user interaction. Attack complexity is low.
  • Impact: Full authentication bypass leading to administrative access to the API — high impact to confidentiality, integrity, and availability of the affected system.
  • Exploitation status: Cisco PSIRT confirmed active exploitation of this vulnerability in the wild as of September 2026.

Affected software

Cisco Catalyst SD-WAN Manager, regardless of system configuration:

  • Earlier than 20.9
  • 20.9.x through 20.9.10.0
  • 20.12.x through 20.12.8.1
  • 20.15.x through 20.15.6.0
  • 20.18.x through 20.18.4.0
  • 26.1.x through 26.1.2.0
  • 26.2.x through 26.2.0

Severity

  • CVSS v3.1 Base Score: 9.8 (Critical)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation and recommended actions

  • Immediate: Upgrade Cisco Catalyst SD-WAN Manager to a fixed release:
    • 20.9.10.1 or later
    • 20.12.8.2 or later
    • 20.15.6.1 or later
    • 20.18.4.1 or later
    • 26.1.2.1 or later
    • 26.2.1 or later
    • Cisco SD-WAN Cloud (Cisco Managed) deployments were already remediated in Release 20.15.605; no customer action is required for that deployment model.
  • If patching cannot be performed immediately: Cisco states there are no workarounds for this vulnerability. As a mitigation for on-premises deployments, restrict access to the system from unsecured networks such as the internet; if internet access is required, restrict it to known, trusted hosts on approved ports/protocols, and place SD-WAN control components behind a firewall or filtering device.
  • Audit serviceproxy-access.log and vmanage-server.log for suspicious j_security_check requests (particularly those using URI-encoded characters, e.g. %6a) originating from unknown or unauthorized IP addresses, and for activity associated with viptela-reserved- system service accounts, as potential indicators of compromise.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge