Cisco warns attackers exploit critical SD-WAN Manager authentication bypass

September 30, 2026 at 08:24 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Attackers are exploiting a critical authentication bypass in Cisco Catalyst SD-WAN Manager, Cisco said on September 30. The flaw, CVE-2026-76504, carries a CVSS score of 9.8 and allows unauthenticated remote attackers to use the Manager's API as the admin user. Fixed releases are available, but there is no workaround.

Key Facts

CVE-2026-76504 has a CVSS score of 9.8 out of 10.
The flaw affects Cisco Catalyst SD-WAN Manager regardless of configuration, and no other product is listed as affected.
Cisco's Product Security Incident Response Team became aware of active exploitation in September 2026.
Fixed releases are available for release trains 20.9, 20.12, 20.15, 20.18, 26.1, and 26.2.
Cisco SD-WAN Cloud (Cisco Managed) is already fixed in release 20.15.605, and customers on it need to take no action.

The Vulnerability

CVE-2026-76504 sits in the part of the Manager's API that handles login sessions. The Manager mishandles URI encoding in an HTTP request, allowing a crafted request to bypass an authentication rule intended to restrict access to a single API endpoint. The attacker needs no credentials, only the ability to send that request to the Manager's API. By default, the admin user holds the netadmin role, which is allowed to perform all operations on the device.

Exploitation and Response

Cisco's Product Security Incident Response Team became aware of active exploitation of this vulnerability in September 2026. The flaw was found while Cisco's Technical Assistance Center (TAC) was handling a support case. The advisory does not say how many customers were attacked, when the attacks began, who carried them out, or what the attackers did with the access. Managers exposed to the internet are at risk of compromise, according to Cisco.

Fixed Releases and Mitigation

The first fixed releases are 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1. CVE-2026-76504 is separate from three Cisco SD-WAN flaws fixed earlier: CVE-2026-20182 in May, and CVE-2026-20245 and CVE-2026-20262 in June. A comparison of the advisories shows that the fixed releases for those flaws are all older than the ones in the table above, so a Manager last upgraded for the May or June fixes still needs this update. Until an on-prem Manager is upgraded, Cisco advises restricting access to it from unsecured networks such as the internet. Cisco Catalyst SD-WAN Cloud Hosted environments already have this mitigation in place.