Cisco Catalyst SD-WAN Manager Authentication Bypass
Unauthenticated attackers can gain admin access to Cisco Catalyst SD-WAN Manager via a URI encoding flaw. CVSS 9.8, actively exploited, CISA KEV listed.
- Vendor
- Cisco
- Product
- Catalyst SD-WAN Manager
- CVSS
- 9.8
- EPSS (exploit probability)
- 1.8%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Cisco Catalyst SD-WAN Manager authenticates incoming requests by matching URI paths against access rules. CVE-2026-76504 is a flaw in that logic: the application does not properly validate hex-encoded URI characters, so an unauthenticated attacker can send a crafted HTTP request that bypasses the authentication check and obtains admin-level access. CVSS score is 9.8 (Critical), confirmed by NVD.
SD-WAN Manager is the centralized orchestration plane for Cisco SD-WAN deployments. Admin access means an attacker can modify network configurations, access stored credentials, and potentially reach connected branch edge devices.
Affected products
Cisco Catalyst SD-WAN Manager. See the Cisco advisory for the full version matrix and patched releases. The advisory was published September 30, 2026.
Exploitation status
CISA added CVE-2026-76504 to the Known Exploited Vulnerabilities catalog on September 30, 2026, confirming active exploitation in the wild. Federal agencies must remediate by October 3, 2026, per CISA BOD 26-04. Rapid7 published an emergency threat response the same day.
Mitigation
Apply the fixed software from Cisco’s September 30 advisory. If patching is not immediately possible, restrict SD-WAN Manager to trusted management networks and follow Cisco’s interim guidance in the advisory.
