New Cisco SD-WAN zero-day exploited in-the-wild (CVE-2026-76504)
Attackers are exploiting Cisco SD-WAN Manager auth bypass CVE-2026-76504, now listed in CISA's KEV catalog.
Cisco disclosed active exploitation of CVE-2026-76504, an API authentication bypass in Catalyst SD-WAN Manager caused by improper URI-encoding handling. A crafted HTTP request can reach a restricted API as the admin user and potentially give an attacker control of the managed network. Affected trains include 26.2, 26.1, 20.18, 20.15, 20.12, 20.9, and releases earlier than 20.9; fixes exist for 20.9 through 26.2, with no workaround. CISA added the flaw to the KEV catalog and ordered US federal civilian agencies to remediate and assess compromise by October 3, 2026.
- CVE-2026-76504 bypasses Catalyst SD-WAN Manager API authentication via URI encoding.
- Successful exploitation grants API access as the admin user.
- Fixed releases cover 20.9 through 26.2; earlier builds require migration.
- Cisco incident response confirmed exploitation in September 2026.
- CISA KEV orders federal civilian agencies to act by October 3, 2026.
Vulnerabilities mentionedAll →
- CVE-2026-765049.82%Unauthenticated admin API auth bypass in Cisco Catalyst SD-WAN Managerpublished · Cisco Catalyst SD-WAN Manager KEV PoC
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 20.9.10.1 | .9 through 26.2, but those running any release earlier that 20.9.10.1 should migrate to one of the fixed versions, as there are n |
Full article464 words · extracted from helpnetsecurity.com · click to collapse
For the fifth time this year, Cisco revealed attackers have exploited a vulnerability (CVE-2026-76504) in its SD-WAN solution in zero-day attacks.
The vendor’s incident responders became aware of active exploitation of this vulnerability in September 2026, after getting pinged and resolving a Cisco Technical Assistance Center (TAC) support case.
Cisco has yet to share any details about the attacks, but it has provided indicators of compromise defenders should look for to check whether they have been targeted.
About CVE-2026-76504
CVE-2026-76504 is an API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager, the central management console for Cisco’s software-defined wide area network solution. Compromising it can give attackers control over the network.
“This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint,” Cisco explained.
“An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.”
CVE-2026-76504 affects the following releases of Cisco Catalyst SD-WAN Manager, regardless of system configuration: 26.2, 26.1, 20.18, 20.15, 20.12, 20.9, and releases earlier than 20.9.
What to do?
Security updates carrying a fix have been provided for releases 20.9 through 26.2, but those running any release earlier that 20.9.10.1 should migrate to one of the fixed versions, as there are no workarounds that address this vulnerability.
“As a mitigation for On-Prem deployment customer environments, [customers] should restrict access from unsecured networks, such as the internet, to the system,” Cisco advised. “If access to the system is required from the internet, restrict system access to only known, trusted hosts on ports and protocols that are included in the user guides.”
But before implementing the security update, they should check whether their internet-exposed systems have been probed by attackers, or at least collect logs and a snapshot of the device for threat hunting once they have updated.
Among the indicators of compromise (IoCs) outlined by the vendor are entires in the serviceproxy-access.log and vmanage-server.log files.
“In some instances, these indicators of compromise (IOCs) may occur during standard operations. Therefore, they must be assessed against normal network posture to identify and avoid false positives,” Cisco noted, and said that customers may open a case with its TAC to get the vendor’s help in the investigation.
The US Cybersecurity and Infrastructure Security Agency has added CVE-2026-76504 to its Known Exploited Vulnerabilities catalog and ordered US federal civilian agencies to address it by October 3, 2026 and perform a compromise assessment.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!