U.S. CISA adds Cisco Catalyst SD-WAN Manager flaw to its Known Exploited Vulnerabilities catalog
CISA lists actively exploited Cisco SD-WAN Manager flaw CVE-2026-76504 in the KEV catalog.
CISA added CVE-2026-76504, a CVSS 9.8 flaw in Cisco Catalyst SD-WAN Manager, to its Known Exploited Vulnerabilities catalog. Improper URI encoding in HTTP requests lets an unauthenticated remote attacker bypass session checks and access a restricted API as the admin user. Cisco PSIRT said it learned of active exploitation in September 2026, and no workaround is available. Federal agencies must remediate by October 2, 2026; fixed releases include 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1.
- CVE-2026-76504 is a CVSS 9.8 unauthenticated authentication bypass.
- Crafted HTTP requests grant admin access to the SD-WAN Manager API.
- Cisco PSIRT confirmed active exploitation in September 2026.
- No workaround exists; several fixed SD-WAN releases are available.
- CISA ordered federal agencies to remediate by October 2, 2026.
Vulnerabilities mentionedAll →
- CVE-2026-765049.82%Unauthenticated admin API auth bypass in Cisco Catalyst SD-WAN Managerpublished · Cisco Catalyst SD-WAN Manager KEV PoC
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 20.12.8.2 | than 20.9 Migrate to a fixed release. 20.9 20.9.10.1 20.12 20.12.8.2 20.15 20.15.6.1 20.18 20.18.4.1 26.1 26.1.2.1 26.2 26.2.1 “ |
| ipv4 | 20.15.6.1 | te to a fixed release. 20.9 20.9.10.1 20.12 20.12.8.2 20.15 20.15.6.1 20.18 20.18.4.1 26.1 26.1.2.1 26.2 26.2.1 “Cisco strongly r |
| ipv4 | 20.18.4.1 | lease. 20.9 20.9.10.1 20.12 20.12.8.2 20.15 20.15.6.1 20.18 20.18.4.1 26.1 26.1.2.1 26.2 26.2.1 “Cisco strongly recommends that c |
| ipv4 | 20.9.10.1 | Release Earlier than 20.9 Migrate to a fixed release. 20.9 20.9.10.1 20.12 20.12.8.2 20.15 20.15.6.1 20.18 20.18.4.1 26.1 26.1.2 |
| ipv4 | 26.1.2.1 | 9.10.1 20.12 20.12.8.2 20.15 20.15.6.1 20.18 20.18.4.1 26.1 26.1.2.1 26.2 26.2.1 “Cisco strongly recommends that customers upgra |
Full article538 words · extracted from securityaffairs.com · click to collapse
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Cisco Catalyst SD-WAN Manager flaw to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Cisco Catalyst SD-WAN Manager flaw, tracked as CVE-2026-76504 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog.
The vulnerability resides in Cisco Catalyst SD-WAN Manager’s session authentication and could allow a remote attacker with no credentials to access the system with administrator-level privileges.
“This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system.” reads the advisory. “A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.”
Cisco said its Product Security Incident Response Team learned that attackers were actively exploiting the flaw in September 2026.
“In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.” continues the advisory.
Cisco’s Technical Assistance Center (TAC) discovered the issue while investigating a customer support case.
The company did not disclose how many customers were affected, when the attacks started, who was behind them, or what attackers did after gaining access.
Cisco says there is no workaround for the vulnerability. For on-premises deployments, customers should restrict internet access and place SD-WAN control components behind a firewall, allowing traffic only from trusted hosts. The mitigation is already in place for cloud-hosted environments, but customers should assess its impact before deploying it.
Below are the impacted versions:
| Cisco Catalyst SD-WAN Software Release | First Fixed Release |
|---|---|
| Earlier than 20.9 | Migrate to a fixed release. |
| 20.9 | 20.9.10.1 |
| 20.12 | 20.12.8.2 |
| 20.15 | 20.15.6.1 |
| 20.18 | 20.18.4.1 |
| 26.1 | 26.1.2.1 |
| 26.2 | 26.2.1 |
“Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.”
Internet-exposed Catalyst SD-WAN Manager systems should be checked for signs of compromise, while comparing any findings with normal network activity to avoid false positives. Customers should review the serviceproxy-access.log file at /var/log/nms/containers/service-proxy/serviceproxy-access.log for j_security_check requests coming from unknown or unauthorized IP addresses.
They should also check /var/log/nms/vmanage-server.log for j_security_check requests involving usernames that start with viptela-reserved-. The networking giant notes that the %6a string shown in its example represents the letter j, but any single URL-encoded character could be used in an attack. If a compromise is suspected, customers can contact Cisco TAC by opening a Severity 3 case with CVE-2026-76504 in the title.
Cisco also recommends running the request admin-tech command on the SD-WAN Manager (vManage) and providing the resulting admin-tech file to TAC for analysis.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the flaw by October 2rd, 2026.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)