CISA orders federal agencies to patch Cisco SD-WAN flaw by Oct 3

October 2, 2026 at 11:42 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

The Cybersecurity and Infrastructure Security Agency has ordered federal agencies to remediate a critical Cisco Catalyst SD-WAN Manager authentication bypass by October 3, 2026. The flaw, tracked as CVE-2026-76504, is being actively exploited and carries a CVSS score of 9.8. Cisco has released fixed software versions, but no workarounds are available.

Key Facts

CVE-2026-76504 allows unauthenticated remote attackers to gain administrative access to the Cisco Catalyst SD-WAN Manager API.
The vulnerability has a CVSS score of 9.8 and stems from improper URL encoding handling in the j_security_check path.
CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 30, 2026, with a remediation deadline of October 3, 2026.
Cisco PSIRT confirmed active exploitation in September 2026, marking the fifth actively exploited SD-WAN zero-day in 2026.
Fixed releases are available in versions 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1.

Exploit Mechanism

The vulnerability allows unauthenticated remote attackers to gain administrative access to the management API of Cisco Catalyst SD-WAN Manager. The flaw stems from improper handling of URL/URI encoding, specifically within the j_security_check path. By substituting the character 'j' with its URI-encoded equivalent %6a, an attacker can bypass authentication rules protecting the management API. The SD-WAN Manager acts as a centralized control point for up to 6,000 devices, so compromising a single instance provides extensive control over large-scale network infrastructure.

Federal Response

Cisco PSIRT confirmed active exploitation of this vulnerability in September 2026. CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 30, 2026. Federal agencies are under a strict mandate to remediate the vulnerability by October 3, 2026. There are currently no workarounds available to mitigate this risk; organizations must apply the provided fixed releases.

Broader Pattern

This incident marks the fifth actively exploited SD-WAN zero-day vulnerability in 2026 alone. Previous exploits occurred in February (CVE-2026-20127), May (CVE-2026-20182), and twice in June (CVE-2026-20245, CVE-2026-20262). Since November 2021, CISA has cataloged 90 Cisco vulnerabilities exploited in the wild, seven of which have been leveraged by ransomware operations. Security teams should review system logs for j_security_check entries from unknown IP addresses in serviceproxy-access.log and vmanage-server.log files.