Cisco Catalyst SD-WAN Manager CVE-2026-76504: URL-encoded login path gives unauthenticated admin API access, exploited

What happened

On 30 September 2026, Cisco disclosed CVE-2026-76504, rated CVSS 9.8. SD-WAN Manager mishandles URI encoding in HTTP requests. A crafted request slips past an authentication rule meant to protect a specific API endpoint, and the attacker gets API access as the admin user. No login is needed. It affects SD-WAN Manager “regardless of system configuration” (Cisco).

Cisco says it found the bug while resolving a TAC support case, and that PSIRT became aware of active exploitation in September 2026 (Cisco). CISA added it to KEV the same day, with a due date of 3 October (CISA KEV). Rapid7 told organisations to audit affected systems for compromise (Infosecurity Magazine). No one has publicly attributed the exploitation.

This is a different bug from CVE-2026-20127, the SD-WAN controller peering bypass disclosed in February 2026 (CISA KEV).

Am I affected?

Every on-premises SD-WAN Manager below the fixed release for its train is affected (Cisco):

Cisco-hosted and Cisco-managed cloud deployments already have the fix or a mitigation in place. Cisco SD-WAN Cloud (Cisco Managed) is fixed in 20.15.605. Cloud customers can check their release through Help in the GUI.

Check the logs for exploitation. Cisco gives two places to look (Cisco):

• /var/log/nms/containers/service-proxy/serviceproxy-access.log: j_security_check requests from unknown IP addresses, with a character URL-encoded. Cisco’s example is "POST /%6a_security_check HTTP/1.1", but any character can be encoded.
• /var/log/nms/vmanage-server.log: j_security_check requests tied to users whose names start with viptela-reserved-, for example Request Stored in Map is (/%6a_security_check) for user (viptela-reserved-..).

# Encoded login path: any % in the j_security_check path is suspicious
grep -E '_security_check' /var/log/nms/containers/service-proxy/serviceproxy-access.log | grep -E '/[^ ]*%[0-9A-Fa-f]{2}[^ ]*security_check'

# Logins mapped to reserved system accounts
grep -E 'security_check.*viptela-reserved-' /var/log/nms/vmanage-server.log

Cisco warns that some of these lines can appear in normal operation, so compare with your baseline. Check rotated and archived logs back to at least early September.

What to do now

1. Upgrade to the fixed release for your train. There is no workaround (Cisco).
2. Take the Manager off the internet. Cisco recommends restricting internet access and putting it behind a filtering device, following the Catalyst SD-WAN Hardening Guide.
3. Use the Live Protect shield only as a stopgap. Cisco says it gives “only temporary partial protection”. It can also stop legitimate users whose login uses URI encoding from signing in.
4. If the logs show hits, ask Cisco for a compromise assessment. Run request admin-tech first, then open a Severity 3 TAC case with CVE-2026-76504 in the title and attach the file (Cisco).
5. Review admin activity through the API since September. An attacker with admin API access can change policy and configuration that the Manager pushes to every edge router. Compare current templates, policies and local user accounts with a known-good backup. Rapid7 recommends auditing affected systems for compromise (Infosecurity Magazine).
6. Detection: Cisco lists Snort rule 67179 for this CVE.

Sources

• Cisco: Catalyst SD-WAN Manager API authentication bypass vulnerability (cisco-sa-sdwan-webauth-xr8beuuU)
• CVE-2026-76504 record
• CISA Known Exploited Vulnerabilities catalog
• Infosecurity Magazine: critical Cisco Catalyst SD-WAN zero-day under active exploitation