Cisco Catalyst SD-WAN Manager: Authentication bypass in API session management
Deadline for US federal agencies: 3 Oct 2026
Summary
A flaw in the API session-based authentication of Cisco Catalyst SD-WAN Manager (formerly vManage) allows an unauthenticated remote attacker to reach the API with admin privileges. The attacker sends a crafted HTTP request with URI encoding that bypasses the authentication rule for a restricted API endpoint. Exploitation requires only network access to the Manager, and Cisco reports active exploitation in the wild, so internet-exposed instances are at high risk.
Affected
- Cisco Catalyst SD-WAN Manager, regardless of system configuration.
- The Cisco advisory lists the affected releases; the CVE record names releases from 18.3.x to 20.1.x among others. Status of other release trains: Unknown.
- Cisco-managed cloud (Cisco SD-WAN Cloud Managed Release 20.15.605): addressed, no user action required.
Fixed in
- Upgrade to the first fixed release for your train (per third-party reproduction of the Cisco table, verify against the Cisco advisory before change tickets):
- 20.9 to 20.9.10.1
- 20.12 to 20.12.8.2
- 20.15 to 20.15.6.1
- 20.18 to 20.18.4.1
- 26.1 to 26.1.2.1
- 26.2 to 26.2.1
- Releases earlier than 20.9: migrate to a fixed release first.
- Trains 20.10, 20.11, 20.13, 20.14 and 20.16 are not listed in the table: Unknown, confirm with Cisco.
Workaround
- No workaround addresses this vulnerability; Cisco states the only remedy is an upgrade.
- Cisco's Live Protect shield offers only temporary partial protection and may block legitimate logins that use URI encoding.
- Interim measure only: restrict access to the Manager from the internet and from untrusted networks, and place it behind a filtering device.
Exploitation
- Active exploitation confirmed; Cisco PSIRT became aware of it in September 2026.
- Listed in the CISA Known Exploited Vulnerabilities catalog on 30 Sep 2026, with a federal remediation due date of 3 Oct 2026.
- Public repositories referencing the CVE have appeared, but no reliable, independently verified public exploit has been confirmed.
- Threat actor attribution: Unknown.
Our recommendation
- Identify all Catalyst SD-WAN Manager instances and their exact versions, including any operated by a managed-service provider.
- Upgrade each instance to the first fixed release for its train as a priority; instances last patched for earlier Cisco fixes still need this update.
- Until patched, remove internet exposure of the Manager and restrict access to trusted management networks.
- Hunt for compromise: search the service proxy and server logs for encoded j_security_check requests from unknown IP addresses, review unexpected admin API sessions, and check for new or unknown accounts and configuration changes.
- If compromise is found, treat the Manager as compromised and follow Cisco's guidance on rebuilding the fabric. Confirm the status of unlisted release trains with Cisco directly.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (3 repositories)
ShadowForge-Cyber/CVE-2026-76504-Proof-of-concept · pastelghost3/cve-2026-76504-nuclei · maxprog-svg/CVE-2026-76504-Cisco
Research sources
- Cisco Security Advisory cisco-sa-sdwan-webauth-xr8beuuU sec.cloudapps.cisco.com
- CISA Known Exploited Vulnerabilities Catalog entry www.cisa.gov
- CIS advisory on SD-WAN Manager authentication bypass www.cisecurity.org
- Rapid7 ETR: exploited in the wild www.rapid7.com
- eSentire security advisory www.esentire.com
- watchTowr FAQ on CVE-2026-76504 watchtowr.com
- SOCRadar analysis of CVE-2026-76504 socradar.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:24.
Original description (NVD)
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.
Required action (CISA)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.