Exploited Cisco SD-WAN Manager bypass CVE-2026-76504 added to KEV

CISA added actively exploited Cisco Catalyst SD-WAN Manager auth bypass CVE-2026-76504 (CVSS 9.8) to KEV, with a federal deadline of October 3, 2026.

Cisco disclosed active exploitation of CVE-2026-76504, a critical CVSS 9.8 API authentication bypass in Catalyst SD-WAN Manager, formerly vManage, caused by improper handling of URI encoding. A crafted HTTP request lets an unauthenticated remote attacker reach a restricted API as the admin user without credentials or user interaction. Cisco said it learned of exploitation in September 2026, and the Canadian Centre for Cyber Security advisory AV26-978 says CISA added the flaw to the Known Exploited Vulnerabilities catalog on September 30, 2026, with US federal civilian agencies ordered to remediate by October 3, 2026. AV26-978 names affected versions as those before 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1, while other reports list trains 26.2, 26.1, 20.18, 20.15, 20.12, 20.9, and releases earlier than 20.9, with fixes for 20.9 through 26.2 and migration for older builds. Reports agree there is no workaround; CSO Online says Cisco-managed SD-WAN Cloud is already fixed, while Infosecurity Magazine says cloud-hosted environments received a mitigation, and SOCRadar's truncated account only urges applying a fix when available rather than citing fixed builds. Cisco published log indicators for encoded j_security_check requests and accounts starting with viptela-reserved-, and Infosecurity also recalled last month's exploited Cisco ISE flaw CVE-2026-76460 (CVSS 10).