API Authentication Bypass Vulnerability in Cisco Catalyst SD-WAN Manager
CVE-2026-76504

9.8CRITICAL

Key Information:

Vendor

Cisco
Status
Cisco Catalyst Sd-wan Manager
Vendor
CVE Published:
30 September 2026

Badges

📈 Trended📈 Score: 4,150👾 Exploit Exists🦅 CISA Reported📰 News Worthy

What is CVE-2026-76504?

CVE-2026-76504 is a significant vulnerability impacting the Cisco Catalyst SD-WAN Manager, a software product designed to help organizations manage their Wide Area Network (WAN) infrastructure efficiently. This vulnerability arises from a flaw in the API session-based authentication management, which improperly handles URI encoding. Through this security oversight, an unauthenticated remote attacker can craft malicious HTTP requests that bypass intended authentication mechanisms, granting them administrative access to the system.

The implications of this vulnerability are profound, as an attacker with admin privileges can manipulate network configurations, access sensitive data, and potentially disrupt operations without any prior authentication. This undermines the trustworthiness of the overall network management system and could expose organizations to a variety of security threats, including unauthorized data access and operational sabotage.

Potential impact of CVE-2026-76504

  1. Unauthorized Access: The vulnerability allows attackers to gain unauthorized admin-level access to the Cisco Catalyst SD-WAN Manager, which could lead to control over critical networking components.

  2. Data Breaches: With enhanced privileges, attackers can access sensitive configurations and data, increasing the risk of data breaches and exposing confidential organizational information.

  3. Operational Disruption: The ability to alter network settings can lead to severe disruptions in service availability, causing downtime, loss of productivity, and potentially resulting in financial losses for the affected organization.

CISA has reported CVE-2026-76504

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-76504 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

Cisco Catalyst SD-WAN Manager 20.1.12

Cisco Catalyst SD-WAN Manager 19.2.1

Cisco Catalyst SD-WAN Manager 18.4.4

News Articles

favicon imageSwapupdate

CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV - SwapUpdate

Ravie LakshmananOct 01, 2026Vulnerability / Network Security

3 weeks ago

favicon imageWater Information Sharing And Analysis Center

(TLP:CLEAR) Vulnerability Notification - Cisco SD-WAN Manager Actively Exploited - WaterISAC

ACTION MAY BE REQUIRED for utilities using Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage). Utilities that outsource technology support may need to consult their service providers for assistance with...

3 weeks ago

favicon imageItnews

Cisco says no workaround for exploited SD-WAN Manager flaw

Key points Cisco warns attackers are actively exploiting a critical authentication bypass, tracked as CVE-2026-76504 with a CVSS score of 9.8, in its Catalyst SD-WAN Manager software. The flaw lets an...

3 weeks ago

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 📈

    Vulnerability started trending

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • 📰

    First article discovered by BleepingComputer

  • Vulnerability published

  • Vulnerability Reserved

.