On September 30, 2026, Cisco disclosed an authentication bypass in Catalyst SD-WAN Manager that attackers are already exploiting. It is tracked as CVE-2026-76504 and published in advisory cisco-sa-sdwan-webauth-xr8beuuU with a CVSS 3.1 score of 9.8. The flaw could let an unauthenticated remote attacker access an affected system's API with the privileges of the admin user. Cisco says the vulnerability affects Catalyst SD-WAN Manager "regardless of system configuration," and that "there are no workarounds that address this vulnerability."

The Cybersecurity and Infrastructure Security Agency (CISA) added the bug to its Known Exploited Vulnerabilities (KEV) catalog on September 30, the same day Cisco disclosed it. Under Binding Operational Directive 26-04, CISA gave federal civilian agencies until October 3 to address it, three days after the listing. That federal deadline passed 16 days ago.

What the flaw does

Cisco and the National Vulnerability Database (NVD) both describe the root cause as improper handling of URI encoding in an HTTP request. A crafted request can get past an authentication rule meant to restrict access to a specific API endpoint. Cisco classifies the weakness as CWE-177, and CISA's KEV entry calls it the "Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability." The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable attack of low complexity that needs no privileges and no user interaction, with high impact to confidentiality, integrity and availability.

What is known about the attacks

Cisco wrote that "in September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." The advisory says the flaw itself was found while a Cisco Technical Assistance Center (TAC) support case was being resolved. According to The Hacker News, Cisco has not said who is behind the attacks, how many organizations have been compromised, or when exploitation first occurred.

Help Net Security reported that this is the fifth time this year Cisco has revealed that attackers exploited a vulnerability. Jake Knott, head of threat intelligence at watchTowr, said in a statement to The Hacker News that "Cisco SD-WAN feels like an ever-present staple of the CISA Known Exploited vulnerabilities list." He said eight 2026 Cisco SD-WAN CVEs had landed on KEV this year; the KEV catalog lists eight Cisco SD-WAN entries with 2026 CVE IDs, added between February 25 and September 30.

Affected and fixed releases

Cisco's advisory lists these first fixed releases for on-premises deployments:

  • 20.9: 20.9.10.1
  • 20.12: 20.12.8.2
  • 20.15: 20.15.6.1
  • 20.18: 20.18.4.1
  • 26.1: 26.1.2.1
  • 26.2: 26.2.1

For releases earlier than 20.9, the advisory tells customers to migrate to a fixed release. Cisco says it fixed the flaw in Cisco SD-WAN Cloud (Cisco Managed) release 20.15.605 and that no user action is required there.

On October 2, Cisco updated the advisory to version 1.1 to add details of a Live Protect shield for the issue. Cisco describes the shield as temporary, partial protection while customers plan upgrades, and says upgrading to a fixed release is the only way to remediate the flaw. The shield has a side effect: a legitimate user who uses URI encoding might not be able to log in to SD-WAN Manager. For on-premises deployments, Cisco also recommends restricting access from untrusted networks such as the internet and placing control components behind a filtering device. It says cloud-hosted environments already have that mitigation in place.

Indicators of compromise

Cisco has published log-based indicators of compromise covering two files, serviceproxy-access.log and vmanage-server.log. Defenders are told to look for j_security_check entries from unknown or unauthorized IP addresses, especially entries involving users whose names start with viptela-reserved-. Cisco cautions that "these indicators of compromise (IOCs) may occur during standard operations" in some instances, and that they must be assessed against normal network posture to avoid false positives.

CISA's KEV entry marks the flaw for forensic triage, so federal agencies must also meet CISA's Forensics Triage Requirements under BOD 26-04, not only patch. Help Net Security advises checking, before patching, whether internet-exposed systems have been probed by attackers. If that is not possible, it recommends collecting logs and a device snapshot so threat hunting can be done after updating. Cisco says customers can open a TAC case for help with an investigation.

What It Means for Defenders

  • Upgrade every on-premises instance to the fixed release for its train (listed above), and schedule migrations for anything older than 20.9. Use the Live Protect shield only to cover the gap until the upgrade is done.
  • Capture evidence first. Before upgrading, pull the two log files named above and take a device snapshot, so you can hunt for prior access afterward.
  • Hunt with Cisco's IOCs and compare any hits against your known administrative sources before concluding that a system is compromised.
  • Cut off untrusted access. Keep SD-WAN Manager and the other control components off the internet and behind a filtering device, as Cisco recommends.
  • Escalate suspected compromise by running request admin-tech on the affected SD-WAN Manager and opening a Severity 3 TAC case with CVE-2026-76504 in the title, attaching the admin-tech file.

Sources