Story · 5 sources · 5 articlesfirst Sep 30, 13:00 UTCupdated Oct 1, 00:35 UTC (3h ago)

CVE-2026-76504 | Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability | Reversed by Horizon3

criticalExploit / PoCexploited in the wildimportance 90CVE-2026-76504 CVE-2026-20127 CVE-2026-20182 CVE-2026-20245 CVE-2026-20262

Merged summary · from the lead article

Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability | Reversed by Horizon3 CVE-2026-76504 is a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager that allows an unauthenticated remote attacker to gain API access as the admin user. Cisco assigns it a CVSS 3.1 score of 9.8 and has confirmed active exploitation. CISA added the vulnerability to its Known…

VendorsCisco

ProductsCisco Catalyst SD-WAN Manager Cisco SD-WAN Cloud Catalyst SD-WAN Manager Catalyst SD-WAN Controller

OrganizationsRapid7 Cisco CISA Cisco PSIRT

Coverage timelineoldest first · each row is one article

Sep 30, 13:00 UTC · 15h ago
Cisco Security Advisories· 69
Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability
Cisco warns an SD-WAN Manager API flaw lets unauthenticated attackers gain admin access.
Sep 30, 14:46 UTC · 13h ago
BleepingComputer· 86
Cisco warns of new SD-WAN zero-day exploited in attacks
Cisco says attackers are exploiting critical SD-WAN Manager auth-bypass zero-day CVE-2026-76504.
Sep 30, 15:09 UTC · 13h ago
Rapid7 Blog· 88
Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)

Vulnerabilities in this storyAll →

CVE-2026-2012710.088%
Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator
published Feb 25, 2026· Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart) KEV
CVE-2026-2018210.0

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-20127	Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator A flaw in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage), and Validator (formerly vBond) allows an unauthenticated, remote attacker to bypass authentication by sending crafted requests to an affected system. A successful exploit grants the attacker access as an internal, high-privileged, non-root user on the SD-WAN Controller, from which they can reach NETCONF and manipulate the network configuration of the entire SD-WAN fabric. Any organization operating these Cisco SD-WAN control-plane components is affected, and the critical CVSS 10.0 score reflects full network scope with no privileges or user interaction required. The flaw is confirmed exploited in the wild: CISA added it to the KEV on 2026-02-25, Cisco has confirmed active exploitation (including a compromise of a communications service provider), and Five Eyes allies have issued an active-exploitation warning, with EPSS at 88.2% (100th percentile). Do: Upgrade affected Catalyst SD-WAN Controller, Manager, and Validator components per Cisco's PSIRT advisory (fixed versions are not specified in this data), and prioritize patching given confirmed in-the-wild exploitation. Follow CISA Emergency Directive 26-03 and the CISA Hunt & Hardening Guidance for Cisco SD-WAN Devices: hunt for compromise indicators such as unexpected high-privileged non-root logins and unauthorized NETCONF configuration changes, and restrict internet exposure of SD-WAN management interfaces. Where mitigations are unavailable, adhere to applicable BOD 22-01 cloud guidance or discontinue use of the product.	10.0	88%	KEV	Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart) Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) Cisco Catalyst SD-WAN Validator (formerly SD-WAN vBond Orchestrator)	large≈10,000–100,000 controller/manager/validator deployments across enterprise and service-provider SD-WAN fabrics (Cisco SD-WAN is a market-leading enterprise…	Feb 25, 2026 KEV Feb 25, 2026
CVE-2026-20182	Authentication Bypass in Cisco Catalyst SD-WAN Control Components CVE-2026-20182 is a critical authentication flaw (CWE-287) in the control-connection peering authentication of Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage), and Validator (formerly vBond). Because the peering authentication mechanism does not work properly, an unauthenticated, remote attacker can send crafted requests during the control-connection handshake and log in to the controller as an internal, high-privileged, non-root user without valid credentials. With this access, the attacker can reach NETCONF and manipulate network configuration across the entire SD-WAN fabric. Any organization running these Catalyst SD-WAN control components is affected, and the flaw carries a CVSS 3.1 score of 10.0 and a 91.5% EPSS score. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-05-14, confirming exploitation in the wild, amid a series of exploited Cisco SD-WAN zero-days including a compromise at a communications service provider. Do: Upgrade affected Catalyst SD-WAN Controller, Manager, and Validator components to the fixed releases identified in Cisco's May 2026 advisory (version numbers are not provided in this data). Use the advisory's 'show control connections' guidance to inspect control-connection handshaking for anomalies and audit for unauthorized high-privileged non-root accounts and unexpected NETCONF sessions. Operators — especially federal agencies — should follow CISA Emergency Directive 26-03 and CISA's Hunt & Hardening Guidance for Cisco SD-WAN Devices, including restricting internet exposure of SD-WAN management interfaces until patched.	10.0	92%	KEV
CVE-2026-20245	Command Injection as Root in Cisco Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) contains an improper encoding or escaping of output flaw (CWE-116) in its handling of user-supplied files. An attacker who already has authenticated access to the system can trigger it by supplying a crafted file, because the file's contents are not properly escaped before being processed. Successful exploitation yields arbitrary command execution with root privileges, giving the attacker full control of the SD-WAN management platform. Organizations running Cisco Catalyst SD-WAN Manager/vManage to manage their SD-WAN fabric are affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-09, indicating active exploitation, though no public proof-of-concept is known and ransomware use has not been confirmed. Do: Apply the fixed release per Cisco's security advisory (specific fixed versions are not included in the available data), and prioritize this patch given the KEV listing. Because the flaw requires authenticated local access, restrict management-plane access to trusted administrators and networks, review privileged accounts on the manager, and audit the system for unexpected processes or changes. Federal agencies must follow the KEV required action under BOD 22-01 (mitigate per vendor instructions or discontinue use).	7.8	25%	KEV	Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage)
CVE-2026-20262	Authenticated Path Traversal File Overwrite in Cisco Catalyst SD-WAN Manager CVE-2026-20262 is a directory/path traversal vulnerability (CWE-22) in Cisco Catalyst SD-WAN Manager, the central management component of Cisco's enterprise SD-WAN solution. An authenticated, remote attacker can supply crafted input containing traversal sequences that escape the intended directory, allowing the attacker to create a new file or overwrite any file on the affected system's filesystem. Overwriting arbitrary files can enable configuration tampering, persistence, or privilege escalation on the management appliance depending on which file is targeted. Any organization running Cisco Catalyst SD-WAN Manager is affected, with greatest risk where the management interface is reachable by broad user populations or from the internet. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-06-15, indicating exploitation in the wild; no public proof-of-concept is known, ransomware association is unknown, CVSS is not yet scored, and EPSS assigns a 28.2% probability of exploitation within 30 days (98th percentile). Do: Apply the fixed release per Cisco's advisory (specific fixed versions are not provided in this data set, so consult Cisco's security notice) and follow CISA's KEV required action, including BOD 26-04 timelines for federal agencies and cloud service use. Until patched, restrict access to the SD-WAN Manager management interface to trusted management networks, enforce strong authentication, and audit the filesystem for unexpectedly created or recently modified files that could indicate exploitation. Evaluate each instance's internet exposure and prioritize internet-reachable management appliances for immediate remediation.	6.5	28%	KEV
CVE-2026-76504	Unauthenticated admin API auth bypass in Cisco Catalyst SD-WAN Manager Cisco Catalyst SD-WAN Manager has a critical flaw in how it manages API session authentication. Improper handling of URI encoding in an HTTP request can bypass an authentication rule that is supposed to restrict a specific API endpoint. An unauthenticated remote attacker can send a crafted HTTP request and gain access to the API with admin privileges, affecting confidentiality, integrity, and availability (CVSS 9.8). Organizations that run Catalyst SD-WAN Manager are affected; the provided data does not list vulnerable or fixed version ranges. No public proof-of-concept is known and the issue is not in CISA's Known Exploited Vulnerabilities catalog. Do: Install Cisco's fixed release for Catalyst SD-WAN Manager as soon as it is available for your deployment; the supplied data does not name vulnerable or fixed versions. Until patched, keep the Manager API off the internet and limit it to trusted management networks, and review API logs for unexpected unauthenticated requests that reach admin-only endpoints.	9.8	—	KEV PoC	Cisco Catalyst SD-WAN Manager	—	14h ago KEV Sep 30, 2026

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-20127

Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator

A flaw in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage), and Validator (formerly vBond) allows an unauthenticated, remote attacker to bypass authentication by sending crafted requests to an affected system. A successful exploit grants the attacker access as an internal, high-privileged, non-root user on the SD-WAN Controller, from which they can reach NETCONF and manipulate the network configuration of the entire SD-WAN fabric. Any organization operating these Cisco SD-WAN control-plane components is affected, and the critical CVSS 10.0 score reflects full network scope with no privileges or user interaction required. The flaw is confirmed exploited in the wild: CISA added it to the KEV on 2026-02-25, Cisco has confirmed active exploitation (including a compromise of a communications service provider), and Five Eyes allies have issued an active-exploitation warning, with EPSS at 88.2% (100th percentile).

Do: Upgrade affected Catalyst SD-WAN Controller, Manager, and Validator components per Cisco's PSIRT advisory (fixed versions are not specified in this data), and prioritize patching given confirmed in-the-wild exploitation. Follow CISA Emergency Directive 26-03 and the CISA Hunt & Hardening Guidance for Cisco SD-WAN Devices: hunt for compromise indicators such as unexpected high-privileged non-root logins and unauthorized NETCONF configuration changes, and restrict internet exposure of SD-WAN management interfaces. Where mitigations are unavailable, adhere to applicable BOD 22-01 cloud guidance or discontinue use of the product.

10.0

88%

KEV

Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart)
Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage)
Cisco Catalyst SD-WAN Validator (formerly SD-WAN vBond Orchestrator)

large≈10,000–100,000 controller/manager/validator deployments across enterprise and service-provider SD-WAN fabrics (Cisco SD-WAN is a market-leading enterprise…

Feb 25, 2026

KEV Feb 25, 2026

CVE-2026-20182

Authentication Bypass in Cisco Catalyst SD-WAN Control Components

CVE-2026-20182 is a critical authentication flaw (CWE-287) in the control-connection peering authentication of Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage), and Validator (formerly vBond). Because the peering authentication mechanism does not work properly, an unauthenticated, remote attacker can send crafted requests during the control-connection handshake and log in to the controller as an internal, high-privileged, non-root user without valid credentials. With this access, the attacker can reach NETCONF and manipulate network configuration across the entire SD-WAN fabric. Any organization running these Catalyst SD-WAN control components is affected, and the flaw carries a CVSS 3.1 score of 10.0 and a 91.5% EPSS score. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-05-14, confirming exploitation in the wild, amid a series of exploited Cisco SD-WAN zero-days including a compromise at a communications service provider.

Do: Upgrade affected Catalyst SD-WAN Controller, Manager, and Validator components to the fixed releases identified in Cisco's May 2026 advisory (version numbers are not provided in this data). Use the advisory's 'show control connections' guidance to inspect control-connection handshaking for anomalies and audit for unauthorized high-privileged non-root accounts and unexpected NETCONF sessions. Operators — especially federal agencies — should follow CISA Emergency Directive 26-03 and CISA's Hunt & Hardening Guidance for Cisco SD-WAN Devices, including restricting internet exposure of SD-WAN management interfaces until patched.

10.0

92%

KEV

CVE-2026-20245

Command Injection as Root in Cisco Catalyst SD-WAN Manager

Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) contains an improper encoding or escaping of output flaw (CWE-116) in its handling of user-supplied files. An attacker who already has authenticated access to the system can trigger it by supplying a crafted file, because the file's contents are not properly escaped before being processed. Successful exploitation yields arbitrary command execution with root privileges, giving the attacker full control of the SD-WAN management platform. Organizations running Cisco Catalyst SD-WAN Manager/vManage to manage their SD-WAN fabric are affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-09, indicating active exploitation, though no public proof-of-concept is known and ransomware use has not been confirmed.

Do: Apply the fixed release per Cisco's security advisory (specific fixed versions are not included in the available data), and prioritize this patch given the KEV listing. Because the flaw requires authenticated local access, restrict management-plane access to trusted administrators and networks, review privileged accounts on the manager, and audit the system for unexpected processes or changes. Federal agencies must follow the KEV required action under BOD 22-01 (mitigate per vendor instructions or discontinue use).

7.8

25%

KEV

Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage)

CVE-2026-20262

Authenticated Path Traversal File Overwrite in Cisco Catalyst SD-WAN Manager

CVE-2026-20262 is a directory/path traversal vulnerability (CWE-22) in Cisco Catalyst SD-WAN Manager, the central management component of Cisco's enterprise SD-WAN solution. An authenticated, remote attacker can supply crafted input containing traversal sequences that escape the intended directory, allowing the attacker to create a new file or overwrite any file on the affected system's filesystem. Overwriting arbitrary files can enable configuration tampering, persistence, or privilege escalation on the management appliance depending on which file is targeted. Any organization running Cisco Catalyst SD-WAN Manager is affected, with greatest risk where the management interface is reachable by broad user populations or from the internet. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-06-15, indicating exploitation in the wild; no public proof-of-concept is known, ransomware association is unknown, CVSS is not yet scored, and EPSS assigns a 28.2% probability of exploitation within 30 days (98th percentile).

Do: Apply the fixed release per Cisco's advisory (specific fixed versions are not provided in this data set, so consult Cisco's security notice) and follow CISA's KEV required action, including BOD 26-04 timelines for federal agencies and cloud service use. Until patched, restrict access to the SD-WAN Manager management interface to trusted management networks, enforce strong authentication, and audit the filesystem for unexpectedly created or recently modified files that could indicate exploitation. Evaluate each instance's internet exposure and prioritize internet-reachable management appliances for immediate remediation.

6.5

28%

KEV

CVE-2026-76504

Unauthenticated admin API auth bypass in Cisco Catalyst SD-WAN Manager

Cisco Catalyst SD-WAN Manager has a critical flaw in how it manages API session authentication. Improper handling of URI encoding in an HTTP request can bypass an authentication rule that is supposed to restrict a specific API endpoint. An unauthenticated remote attacker can send a crafted HTTP request and gain access to the API with admin privileges, affecting confidentiality, integrity, and availability (CVSS 9.8). Organizations that run Catalyst SD-WAN Manager are affected; the provided data does not list vulnerable or fixed version ranges. No public proof-of-concept is known and the issue is not in CISA's Known Exploited Vulnerabilities catalog.

Do: Install Cisco's fixed release for Catalyst SD-WAN Manager as soon as it is available for your deployment; the supplied data does not name vulnerable or fixed versions. Until patched, keep the Manager API off the internet and limit it to trusted management networks, and review API logs for unexpected unauthenticated requests that reach admin-only endpoints.

9.8

—

KEV PoC

Cisco Catalyst SD-WAN Manager

—

14h ago

KEV Sep 30, 2026