CVE-2026-76504: Cisco SD-WAN Flaw Exploited

Cisco Catalyst SD-WAN Manager has a critical flaw in how it manages API session authentication. Improper handling of URI encoding in an HTTP request can bypass an authentication rule that is supposed to restrict a specific API endpoint. An unauthenticated remote attacker can send a crafted HTTP request and gain access to the API with admin privileges, affecting confidentiality, integrity, and availability (CVSS 9.8). Organizations that run Catalyst SD-WAN Manager are affected; the provided data does not list vulnerable or fixed version ranges. No public proof-of-concept is known and the issue is not in CISA's Known Exploited Vulnerabilities catalog.

Do: Install Cisco's fixed release for Catalyst SD-WAN Manager as soon as it is available for your deployment; the supplied data does not name vulnerable or fixed versions. Until patched, keep the Manager API off the internet and limit it to trusted management networks, and review API logs for unexpected unauthenticated requests that reach admin-only endpoints.