Cisco Catalyst SD-WAN Manager (Product): news timeline & CVEs

Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)

Cisco says CVE-2026-76504, a critical SD-WAN Manager API authentication bypass, is being exploited in the wild.

On September 30, 2026, Cisco disclosed CVE-2026-76504, a CVSS 9.8 API authentication bypass in Cisco Catalyst SD-WAN Manager caused by improper URL-encoding handling. An unauthenticated remote attacker can send a crafted HTTP request and reach a specific API endpoint with admin privileges. Cisco says the flaw is being actively exploited, no workaround is available, and fixed on-premises releases include 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1. Managed Cisco SD-WAN Cloud release 20.15.605 is already patched, and Rapid7 urges emergency upgrades plus log review.

Rapid7 Blogupdated 00:35 UTC · 4h agofirst Sep 30, 15:09 UTC · 13h agoExploit / PoC in the wild 5 sources CVE-2026-76504 CVE-2026-20127 CVE-2026-20182

Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability

Cisco warns an SD-WAN Manager API flaw lets unauthenticated attackers gain admin access.

Cisco disclosed an authentication-bypass vulnerability in the API session management of Catalyst SD-WAN Manager. Improper handling of URI encoding in an HTTP request can bypass a rule meant to restrict a specific API endpoint. An unauthenticated remote attacker can send a crafted request and access the API with admin privileges. Cisco has released software updates; the advisory does not report exploitation in the wild.

Cisco Security Advisoriesupdated 00:35 UTC · 4h agofirst Sep 30, 13:00 UTC · 16h agoVulnerability 5 sources

CISA Adds One Known Exploited Vulnerability to Catalog

CISA added actively exploited Cisco Catalyst SD-WAN Manager flaw CVE-2026-76504 to the Known Exploited Vulnerabilities catalog.

CISA added CVE-2026-76504, a hex-encoding vulnerability in Cisco Catalyst SD-WAN Manager, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The agency said this class of flaw is a frequent attack vector and poses significant risk to federal enterprises. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize remediation of KEV-listed vulnerabilities on publicly exposed assets. CISA encouraged all organizations to remediate cataloged flaws using risk-based vulnerability management.

CISA AdvisoriesSep 30, 12:00 UTC · 17h agoExploit / PoC in the wildCVE-2026-76504

2026-002: Multiple Vulnerabilities in Cisco Products

Cisco fixed SD-WAN Controller auth bypass CVE-2026-20127 (CVSS 10) exploited in the wild since 2023, plus several critical and high flaws in SD-WAN Manager.

On 25 February 2026 Cisco released advisories for multiple flaws in Catalyst SD-WAN Controller and SD-WAN Manager, potentially granting administrative access to attackers. CVE-2026-20127 (CVSS 10.0) is an authentication bypass in the Controller's peering authentication mechanism, exploited in the wild since 2023, allowing unauthenticated admin access via NETCONF, rogue device injection, and persistent access. SD-WAN Manager flaws include CVE-2026-20129 (9.8, unauthenticated API auth bypass to netadmin), CVE-2026-20126 (7.8, local privesc to root), CVE-2026-20133 (7.5, info disclosure), CVE-2026-20122 (7.1, arbitrary file overwrite), and CVE-2026-20128 (5.5, DCA info disclosure). CERT-EU recommends patching, capturing forensic evidence, IOC hunting, and restricting management-plane internet exposure.

CERT-EU AdvisoriesFeb 10, 00:00 UTC · Feb 10, 2026Exploit / PoC in the wildCVE-2026-20127 CVE-2026-20129 CVE-2026-20126+3 CVEs

Cisco Catalyst SD-WAN Manager

Timeline4 articles

Related CVEsby mentions

Appears with

Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)

Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability

CISA Adds One Known Exploited Vulnerability to Catalog

2026-002: Multiple Vulnerabilities in Cisco Products