--- id: "CVE-2026-76504" kind: "vulnerability" aliases: ["CVE-2026-76504"] title: "A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an\u2026" severity: "critical" cvss: 9.8 epss: null exploited: true status: "resolved" category: "vendor" products: [{"name": "Cisco Catalyst SD-WAN Manager", "fixed": ["20.9.10.1", "20.12.8.2", "20.15.6.1", "20.18.4.1", "26.1.2.1", "26.2.1"], "affected": "all releases before the fixed release in each train (20.9, 20.12, 20.15, 20.18, 26.1, 26.2), and all releases earlier than 20.9", "ecosystem": "vendor"}, {"name": "cisco catalyst sd-wan manager", "fixed": ["20.9.10.1"], "affected": "< 20.9.10.1", "ecosystem": "vendor"}, {"name": "cisco catalyst sd-wan manager", "fixed": ["20.12.8.2"], "affected": ">= 20.12, < 20.12.8.2", "ecosystem": "vendor"}, {"name": "cisco catalyst sd-wan manager", "fixed": ["20.15.6.1"], "affected": ">= 20.15, < 20.15.6.1", "ecosystem": "vendor"}, {"name": "cisco catalyst sd-wan manager", "fixed": ["20.18.4.1"], "affected": ">= 20.18, < 20.18.4.1", "ecosystem": "vendor"}, {"name": "cisco catalyst sd-wan manager", "fixed": ["26.1.2.1"], "affected": ">= 26.1, < 26.1.2.1", "ecosystem": "vendor"}, {"name": "cisco catalyst sd-wan manager", "fixed": [], "affected": "= 26.2", "ecosystem": "vendor"}, {"name": "Cisco Catalyst SD-WAN Manager", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["auth-bypass", "catalyst-sd-wan-manager", "cisco", "exploited", "poc-public", "sd-wan", "self-hosted", "vendor"] not_affected_if: ["managed-hosting", "no-sd-wan-manager-deployed"] published_at: "2026-09-30T00:00:00+00:00" first_seen_at: "2026-10-23T19:11:50+00:00" updated_at: "2026-10-24T00:09:50+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76504", "first_seen_at": "2026-10-23T19:11:50+00:00"}, {"source": "github-poc", "url": "https://github.com/maxprog-svg/CVE-2026-76504-Cisco", "first_seen_at": "2026-10-23T20:22:16+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:27:48+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76504", "first_seen_at": "2026-10-23T23:44:52+00:00"}] --- # A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an… Cisco Catalyst SD-WAN Manager (vManage) API authentication bypass. A percent-encoded character in the j_security_check path (e.g. /%6a_security_check) skips the auth rule, so an unauthenticated remote attacker gets admin API access. It affects all configurations. Cisco PSIRT and CISA KEV confirm exploitation. There is no workaround. Cloud-hosted (Cisco-managed) deployments are already fixed and Cisco says no action is needed. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Cisco Catalyst SD-WAN Manager affected all releases before the fixed release in each train (20.9, 20.12, 20.15, 20.18, 26.1, 26.2), and all releases earlier than 20.9 fixed 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, 26.2.1 - vendor:cisco catalyst sd-wan manager affected < 20.9.10.1 fixed 20.9.10.1 - vendor:cisco catalyst sd-wan manager affected >= 20.12, < 20.12.8.2 fixed 20.12.8.2 - vendor:cisco catalyst sd-wan manager affected >= 20.15, < 20.15.6.1 fixed 20.15.6.1 - vendor:cisco catalyst sd-wan manager affected >= 20.18, < 20.18.4.1 fixed 20.18.4.1 - vendor:cisco catalyst sd-wan manager affected >= 26.1, < 26.1.2.1 fixed 26.1.2.1 - vendor:cisco catalyst sd-wan manager affected = 26.2 fixed ? - vendor:Cisco Catalyst SD-WAN Manager affected ? fixed ? ## How to check On the Manager, search /var/log/nms/containers/service-proxy/serviceproxy-access.log for j_security_check requests with encoded characters (e.g. POST /%6a_security_check) from unknown IPs. Search /var/log/nms/vmanage-server.log for j_security_check entries for users named viptela-reserved-*. Any single encoded character can be used, so match on any percent-encoding in that path. Expect some false positives. If you suspect compromise, run 'request admin-tech' and open a Sev 3 Cisco TAC case with the CVE ID in the title. Snort rule 67179 is available. Check your version against the fixed table. ## Fix Upgrade to the first fixed release for your train: 20.9 -> 20.9.10.1; 20.12 -> 20.12.8.2; 20.15 -> 20.15.6.1; 20.18 -> 20.18.4.1; 26.1 -> 26.1.2.1; 26.2 -> 26.2.1. Releases earlier than 20.9 must migrate to a fixed release. Interim only: apply the Cisco Live Protect shield (partial, and it may block legitimate users who use URI encoding at login), and block internet access to the Manager with a firewall that allows only trusted hosts. Review the logs for earlier compromise before and after upgrading. ## Timeline - 2026-10-23T19:11:50+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76504 - 2026-10-23T20:22:16+00:00 github-poc https://github.com/maxprog-svg/CVE-2026-76504-Cisco - 2026-10-23T21:27:48+00:00 analyst — Read Cisco advisory cisco-sa-sdwan-webauth-xr8beuuU (v1.1, CVSS 9.8, CWE-177, Cisco PSIRT confirms exploitation since Sep 2026). Fixed releases and IOC log paths from it. The GitHub PoC repo is public but new (0 stars), and its README ends with a payment link, so treat it as untrusted and do not run it. Its chain matches Cisco's IOC description. - 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76504 ## Documents - [advisory] Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability (cisco-sa-sdwan-webauth-xr8beuuU) https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sdwan-webauth-xr8beuuU.html - [mitigation] Cisco SD-WAN Live Protect Shield Release Notes https://www.cisco.com/c/en/us/td/docs/routers/sdwan/live-protect-rn/cisco-sd-wan-live-protect-shield-release-notes.html - [poc] maxprog-svg/CVE-2026-76504-Cisco https://github.com/maxprog-svg/CVE-2026-76504-Cisco ## From the sources Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_