Cisco Catalyst SD-WAN Manager auth bypass: CVE-2026-76504

Most authentication bypasses in network gear need a foothold first, such as a low-privilege account or an exposed debug service. CVE-2026-76504 needs neither. A request to Cisco Catalyst SD-WAN Manager with part of its path written in URI encoding slips past an authentication rule on one API endpoint, and the sender gets the privileges of the admin user. Cisco rates it 9.8 and lists no workaround.

Cisco found the flaw while resolving a TAC support case, and its PSIRT became aware of active exploitation in September 2026. The advisory was published on 30 September 2026. CISA added the bug to its Known Exploited Vulnerabilities catalog the same day, gave federal agencies until 3 October and marked it as one that requires forensic triage. Cisco revised the advisory on 2 October to add a temporary Live Protect shield.

Who is affected

Cisco says the flaw affects Catalyst SD-WAN Manager regardless of configuration. The first fixed release for each train:

The Cisco-managed SD-WAN Cloud is already fixed in release 20.15.605, and Cisco says those customers need take no action. For self-managed deployments, exposure comes down to who can reach the Manager over the network. Cisco's interim advice is to keep it off the internet and behind a filtering device, as its SD-WAN hardening guide describes. Cloud-hosted environments already have that restriction.

How the authentication bypass works

Cisco has not published the internals. What it has said is that the Manager mishandles URI encoding in HTTP requests, so a crafted request escapes an authentication rule that should cover a specific API endpoint. The weakness Cisco assigned, CWE-177, describes software that does not correctly handle input that is partly or wholly URL-encoded.

The log indicators in the advisory show the shape of an attempt. They point at j_security_check, the form-login path, requested with one or more characters percent-encoded, for example %6a in place of the letter j. Cisco stresses that any character can be encoded, so a literal match on the path name will miss variants.

The preconditions are minimal: network access to the Manager, no credentials and no user interaction. The result, per Cisco, is access to the API with admin-user privileges, scored high for confidentiality, integrity and availability.

Is it being exploited?

Yes. Cisco's advisory states that PSIRT became aware of active exploitation in September 2026. It does not say how the activity came to light, how widespread it is or who is behind it, and Cisco has published no incident details.

CISA added CVE-2026-76504 to the KEV catalog on 30 September 2026 with a due date of 3 October, three days later. The entry marks forensic triage as required under Binding Operational Directive 26-04 and lists ransomware use as unknown. The directive binds federal civilian agencies, but its triage guidance is a sound checklist for anyone: scope the affected systems, collect evidence before patching because patching can destroy it, contain, decide whether a compromise occurred, and aim for an escalation decision within about 72 hours of the listing.

Check your exposure

Start with the release each Manager runs, from its dashboard or your asset inventory, and compare it with the table. Then confirm whether the interface answers from outside your network, and look for the advisory's indicators wherever you can read the Manager's logs:

# From a host outside your network: does the Manager answer at all?
curl -sk -o /dev/null -w '%{http_code}\n' https://sdwan-manager.example.com/
 
# Login requests, plain or with percent-encoded characters in the path
grep -iE 'security_check|POST /[^ ]*%[0-9a-f]{2}' \
  /var/log/nms/containers/service-proxy/serviceproxy-access.log
 
# Login activity for accounts named viptela-reserved-*
grep 'viptela-reserved-' /var/log/nms/vmanage-server.log

Any status other than 000 from the first command means the Manager is reachable from that network. Matches from the other two are leads, not verdicts; the next sections explain how to weigh them.

Fix it

Upgrade to the first fixed release for your train. Releases older than 20.9 have no fixed build in their own train and must move to one that has. Cisco says upgrading is the only complete fix.

If you cannot upgrade at once, Cisco offers two partial measures:

• Restrict access. Remove internet exposure and put the Manager behind a filtering device, following Cisco's hardening guide.
• Live Protect shield. Added in the 2 October revision as temporary, partial protection. Cisco warns it can stop legitimate users whose logins use URI encoding from signing in, so test it before you rely on it.

Detect attempts and compromise

Cisco's advisory lists these signals:

• Service proxy access log. In /var/log/nms/containers/service-proxy/serviceproxy-access.log, requests to j_security_check from addresses you do not recognize, particularly with percent-encoded characters in the path.
• Manager server log. In /var/log/nms/vmanage-server.log, j_security_check activity tied to usernames that begin with viptela-reserved-.
• Network signature. Snort rule 67179.

Cisco cautions that some of these entries can appear during normal operation. Compare hits against a baseline of known administrators and source addresses rather than treating every match as an intrusion.

If they fired, Cisco asks customers to open a Severity 3 TAC case with the CVE ID in the title and attach the output of request admin-tech from the affected system. Treat the Manager as compromised until that review is done, and work through the triage steps above: contain, confirm or rule out compromise, and report where you are required to.

Beyond this patch

The durable lesson is the one in Cisco's interim advice: a management interface should not answer the internet. Pair that with a log baseline for every management plane you run, so that when an advisory names a log line you can tell routine activity from something new in minutes rather than days.