Cisco patches exploited SD-WAN Manager flaw CVE-2026-76504

Cisco patched critical Catalyst SD-WAN Manager authentication bypass CVE-2026-76504 after reported September exploitation and a CISA KEV listing.

Cisco disclosed CVE-2026-76504, a CVSS 9.8 authentication bypass in Catalyst SD-WAN Manager, formerly vManage, tracked internally as CSCww79570 and classified as CWE-177. Improper handling of URI-encoded characters in HTTP requests can let an unauthenticated remote attacker reach a restricted management API as administrator without user interaction; reports say all deployments are affected and no workaround exists. Fixed releases cited across later reports are 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1, while releases earlier than 20.9 must migrate; Cisco-managed SD-WAN Cloud is already mitigated, and Qualys specifically cites cloud release 20.15.605. The earliest report said the advisory did not confirm exploitation, but subsequent reports say Cisco PSIRT learned of active exploitation in September 2026 and that CISA added the flaw to the Known Exploited Vulnerabilities catalog on September 30, 2026. Sources disagree on the federal deadline: Security Affairs reports October 2, 2026, while Qualys, Help Net Security, and The Hacker News report October 3, 2026. Cisco also published indicators involving j_security_check requests and usernames beginning with viptela-reserved-.