Cisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability
Cisco patched CVE-2026-76504, a critical Catalyst SD-WAN Manager auth bypass exploited in the wild and added to KEV.
Cisco patched CVE-2026-76504, a CVSS 9.8 authentication bypass in Catalyst SD-WAN Manager that was exploited in the wild. Improper URI encoding lets a remote unauthenticated attacker send a crafted HTTP request and access a restricted API as admin. All deployments are affected and Cisco says there are no workarounds; fixed releases include 26.2.1, 26.1.2.1, 20.18.4.1, 20.15.6.1, 20.12.8.2, and 20.9.10.1. CISA added the flaw to the KEV catalog and told federal agencies to patch within three days.
- CVE-2026-76504 is a CVSS 9.8 authentication bypass in Catalyst SD-WAN Manager.
- Unauthenticated attackers can reach a restricted API and become admin.
- Cisco saw active exploitation in September 2026; no workarounds exist.
- Fixes include 26.2.1, 26.1.2.1, 20.18.4.1, 20.15.6.1, 20.12.8.2, and 20.9.10.1.
- CISA added the flaw to KEV with a three-day federal patch deadline.
Vulnerabilities mentionedAll →
- CVE-2026-765049.82%Unauthenticated admin API auth bypass in Cisco Catalyst SD-WAN Managerpublished · Cisco Catalyst SD-WAN Manager KEV PoC
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 20.12.8.2 | yst SD-WAN versions 26.2.1, 26.1.2.1, 20.18.4.1, 20.15.6.1, 20.12.8.2, and 20.9.10.1. Cisco-managed SD-WAN deployments have been |
| ipv4 | 20.15.6.1 | ed in Catalyst SD-WAN versions 26.2.1, 26.1.2.1, 20.18.4.1, 20.15.6.1, 20.12.8.2, and 20.9.10.1. Cisco-managed SD-WAN deployments |
| ipv4 | 20.18.4.1 | was resolved in Catalyst SD-WAN versions 26.2.1, 26.1.2.1, 20.18.4.1, 20.15.6.1, 20.12.8.2, and 20.9.10.1. Cisco-managed SD-WAN |
| ipv4 | 26.1.2.1 | 2026-76504 was resolved in Catalyst SD-WAN versions 26.2.1, 26.1.2.1, 20.18.4.1, 20.15.6.1, 20.12.8.2, and 20.9.10.1. Cisco-mana |
Full article419 words · extracted from securityweek.com · click to collapse
Cisco on Wednesday rolled out urgent patches for a critical authentication bypass in Catalyst SD-WAN Manager that has been exploited in the wild.
Tracked as CVE-2026-76504 (CVSS score of 9.8), the flaw impacts the API session-based authentication mechanism and could allow remote, unauthenticated attackers to gain administrative access to a vulnerable system.
“In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability,” the company warned.
According to Cisco, the issue resides in the improper handling of URI encoding in an HTTP request, allowing attacker requests to reach a restricted API endpoint.
“An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user,” Cisco explains.
All Catalyst SD-WAN Manager deployments are affected, regardless of their configuration, and there are no workarounds.
Advertisement. Scroll to continue reading.
CVE-2026-76504 was resolved in Catalyst SD-WAN versions 26.2.1, 26.1.2.1, 20.18.4.1, 20.15.6.1, 20.12.8.2, and 20.9.10.1. Cisco-managed SD-WAN deployments have been patched as well.
Cisco has released indicators of compromise (IoCs) to help security teams hunt for potential exploitation attempts, and published general recommendations for hardening at-risk systems.
On Wednesday, the US cybersecurity agency CISA added the security defect to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within three days.
Neither Cisco nor CISA has shared details on the security bug’s in-the-wild exploitation.
“Cisco SD-WAN feels like an ever-present staple of the CISA Known Exploited Vulnerabilities list, with eight 2026 CVEs landing on KEV this year alone – this should be an extremely clear signal that attackers have recognized the value of the platform, and this pattern is unlikely to slow down,” WatchTowr head of threat intelligence Jake Knott said.
“None of this should surprise anyone. As a single-pane-of-glass used by enterprises to manage, configure, and monitor large networks, it is naturally an attractive target. Organizations running Catalyst SD-WAN Manager should upgrade to a fixed release immediately and follow vendor guidance, including hunting for POST requests to any URL-encoded variants of ‘/j_security_check’ and reviewing instances for signs exploitation has already occurred,” Knott added.
Related: Google: AI Is Changing the Pace and Profile of Vulnerability Discovery
Related: WatchGuard Patches Critical Fireware OS Code Injection Vulnerability
Related: Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks
Related: Chrome, Firefox Updates Patch Over 100 Vulnerabilities