Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

Cisco Patches Exploited Catalyst SD-WAN Manager Auth Bypass

2 sources · 2 articlesFirst reported Updated ()2 · 1 read
What's new

First coverage.

Merged summary · grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Cisco patched exploited Catalyst SD-WAN Manager auth bypass CVE-2026-76504, now in CISA's KEV; sources disagree on the federal deadline.

Cisco patched CVE-2026-76504, a CVSS 9.8 authentication bypass in Catalyst SD-WAN Manager, formerly vManage, caused by improper handling of URI encoding. A remote unauthenticated attacker can send a crafted HTTP request and access a restricted API as the admin user; Cisco says there is no workaround and confirmed it learned of active exploitation in September 2026. Named fixes are 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1, covering trains from 20.9 through 26.2, while builds earlier than 20.9 need migration. Cisco-managed SD-WAN Cloud is already mitigated, but customer-managed deployments must upgrade. CISA added the vulnerability to the KEV catalog on September 30, 2026. Sources disagree on the federal civilian deadline: Security Affairs says October 2, 2026, Help Net Security and The Hacker News say October 3, 2026, and SecurityWeek describes only a three-day window.

Key facts
  • CVE-2026-76504 is a CVSS 9.8 unauthenticated authentication bypass in Cisco Catalyst SD-WAN Manager (formerly vManage).
  • Improper URI-encoding handling lets a remote attacker send a crafted HTTP request and reach a restricted API as admin; Cisco says there is no workaround.
  • Cisco PSIRT and incident response confirmed active exploitation in September 2026.
  • Fixed releases are 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1; affected trains include 26.2, 26.1, 20.18, 20.15, 20.12, 20.9, and releases earlier than 20.9.
  • Cisco-managed SD-WAN Cloud is already mitigated; customer-managed systems on those trains must upgrade.
  • CISA added the flaw to the KEV catalog on September 30, 2026; reported federal deadlines conflict between October 2 and October 3, 2026.
  • Cisco published log indicators involving j_security_check requests and account names starting with viptela-reserved-.
Analyze CVE-2026-76504 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-76504CVE-2026-76460
Vendors
Cisco
Products
Cisco Catalyst SD-WAN ManagerCatalyst SD-WAN ManagerCisco Identity Services EnginevManage
Organizations
CISAWatchTowrIDCCiscowatchTowrRapid7Canadian Centre for Cyber Security
Countries
United States

Coverage

oldest first · one row per article · UTC
  1. · 29d ago SecurityWeekFirst report

    Cisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability

    Cisco patched CVE-2026-76504, a critical Catalyst SD-WAN Manager auth bypass exploited in the wild and added to KEV.

  2. · 29d ago Security Affairs

    U.S. CISA adds Cisco Catalyst SD-WAN Manager flaw to its Known Exploited Vulnerabilities catalog

    CISA lists actively exploited Cisco SD-WAN Manager flaw CVE-2026-76504 in the KEV catalog.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-76460
Unauthenticated Management Interface Bypass in Cisco ISE and ISE-PIC
10.076%KEVPoC
KEV
CVE-2026-76504
Unauthenticated admin API auth bypass in Cisco Catalyst SD-WAN Manager
9.839%KEVPoC ×3
KEV