CVE Tools
Track your stack
One Encoded Character Gets You Admin on Cisco's SD-WAN Manager. It's the Fifth Time That's Happened in 2026.. CVE-2026-76504 slips past an authentication rule guarding Catalyst SD-WAN Manager's API by

One Encoded Character Gets You Admin on Cisco's SD-WAN Manager. It's the Fifth Time That's Happened in 2026.

CVE-2026-76504 slips past an authentication rule guarding Catalyst SD-WAN Manager's API by URL-encoding a single letter. Three of the year's five confirmed SD-WAN zero-days broke the same login layer — the other two picked up from there.

CVE Tools6 min read

CVE-2026-76504In CISA KEVEPSS today 1.8%, 78th percentileCVSS 9.8Open the record

On September 30, 2026, Cisco disclosed CVE-2026-76504: an unauthenticated, remote authentication bypass in Cisco Catalyst SD-WAN Manager, the web console that holds admin rights over an entire SD-WAN fabric. Cisco's own PSIRT says it learned of active exploitation that same month, from a customer TAC case. CISA added the CVE to its Known Exploited Vulnerabilities catalog the day the advisory went out and gave federal agencies until October 3 — a deadline that has already passed.

CVE-2026-76504Cisco Catalyst SD-WAN Manager System Account Authorization Bypass VulnerabilityEPSS 1.8%CVSS 9.8
9.8CVSS (Cisco and NVD agree)AV:N/AC:L/PR:N/UI:N
5thSD-WAN zero-day exploited in 2026per Cisco's own advisory history
1.6%EPSS score in our DB (Oct 6)74th percentile — see why below
Oct 3CISA federal remediation deadlinealready passed

The trick: one encoded character

The bug (CWE-177, improper handling of URI encoding) lives in how SD-WAN Manager's API session authentication checks the login path. A rule is supposed to restrict access to one specific API endpoint. If a request to that endpoint URL-encodes a single character in its path, the rule doesn't recognize the request as the thing it's supposed to block — and lets it through as if it came from an already-authenticated admin.

Cisco's own example from the advisory
POST /%6a_security_check HTTP/1.1# %6a is the URL-encoded form of the letter "j" —# the real target is the login handler at /j_security_check

Five zero-days, one management plane

CVE-2026-76504 isn't an isolated incident. By Cisco and CISA's own account, it's the fifth distinct Catalyst SD-WAN zero-day confirmed exploited in the wild this year. Pulling the CVSS and EPSS data our own database holds on all five tells a more specific story than "Cisco's SD-WAN keeps getting hit": three of the five break the authentication layer itself, and the other two are what an attacker reaches for once a toehold already exists.

Catalyst SD-WAN zero-days confirmed exploited in 2026

  1. CVE-2026-20127 disclosed and patched
    Peering-authentication bypass in SD-WAN Controller/Manager/Validator; exploited since at least 2023 per Cisco.
  2. CVE-2026-20182 disclosed, Rapid7-discovered
    A second, distinct bug in the same control-connection handshake code — same unauthenticated admin-access outcome.
  3. CVE-2026-20245 disclosed
    Mandiant-reported CLI file-upload flaw that lets an already-authenticated netadmin escalate to root.
  4. CVE-2026-20262 disclosed
    Web UI file-write/path-traversal flaw: a logged-in low-privilege account can overwrite any file on disk.
  5. CVE-2026-76504 disclosed, KEV'd same day
    URI-encoding auth-rule bypass on one API endpoint — this article's CVE. CISA deadline: October 3, 2026.
CVEDisclosedCWECVSSEPSS score / percentile (our DB)Auth neededWhat it does
CVE-2026-201272026-02-25CWE-28710.088.5% / 99.8thNoneBypasses peering auth; logs in as an internal privileged account; reaches NETCONF to rewrite fabric config
CVE-2026-201822026-05-14CWE-28710.091.5% / 99.8thNoneSecond, separate bug in the same control-connection handshake; same unauthenticated admin outcome
CVE-2026-202452026-06-04CWE-1167.825.3% / 97.9thnetadmin creds requiredCrafted file upload via a CLI tenant-upload command escalates an authenticated netadmin to root
CVE-2026-202622026-06-15CWE-226.528.2% / 98.1thLow-priv account requiredWeb UI file-upload path traversal lets a logged-in low-priv user overwrite any file — a stepping stone to root
CVE-2026-765042026-09-30CWE-1779.81.6% / 74.6thNoneURI-encoding trick slips past an auth rule on one API endpoint; attacker lands as admin
EPSS score by CVE, our database as of 2026-10-06
CVE-2026-2012788.5CVE-2026-2018291.5CVE-2026-2024525.3CVE-2026-2026228.2CVE-2026-765041.6
LabelValue
CVE-2026-2012788.5
CVE-2026-2018291.5
CVE-2026-2024525.3
CVE-2026-2026228.2
CVE-2026-765041.6
The two May/February auth-bypass bugs have had months to accumulate exploitation telemetry. CVE-2026-76504 is six days old in EPSS terms — its score hasn't caught up to what CISA's KEV listing already confirms.

How CVE-2026-20245 actually got used: Mandiant's chain

Google/Mandiant's writeup on CVE-2026-20245 is the clearest public look at how one of these bugs got chained in a real intrusion against a service provider's SD-WAN infrastructure. It starts with access Mandiant could not fully attribute to a named CVE, and ends with a persistent root account.

Mandiant's observed attack chain against a service-provider SD-WAN deployment

  1. Rogue peering connection (likely stolen cert material)
  2. SSH access as default vmanage-admin account
  3. Admin password reset, web login, config exfiltrated, password reverted
  4. Upload evil_tenant.csv via CLI tenant-upload command (CVE-2026-20245)
  5. Payload creates root-privileged account "troot"
  6. su to troot — root shell obtained
  7. Anti-forensic cleanup + validation script run
The vulnerability will allow any one character that is encoded in the request to be used to exploit this.
— Cisco Security Advisory cisco-sa-sdwan-webauth-xr8beuuU

What to actually check

Cisco's published indicators · j_security_check encoded-character requests and viptela-reserved- logins

Cisco published these log locations and patterns itself in the advisory and in guidance to Rapid7. Cisco explicitly cautions these patterns can also appear during normal operation — evaluate against your own baseline before treating a hit as compromise.

# Review these logs on SD-WAN Manager:
/var/log/nms/containers/service-proxy/serviceproxy-access.log
/var/log/nms/vmanage-server.log

# Look for requests like Cisco's own example:
POST /%6a_security_check HTTP/1.1

# And for usernames beginning with:
viptela-reserved-
Cisco Security Advisory cisco-sa-sdwan-webauth-xr8beuuU
  1. Inventory every Catalyst SD-WAN Manager instance — on-prem or hosted — and its exact release train.
  2. Upgrade to the fixed build for that train: 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, or 26.2.1. Cisco-managed SD-WAN Cloud is already fixed in 20.15.605 — no customer action needed there.
  3. If you cannot patch immediately, apply Cisco's temporary "Live Protect shield" — but note Cisco's own warning that it offers only partial protection and may block legitimate users whose requests happen to use URI encoding.
  4. Pull serviceproxy-access.log and vmanage-server.log and check for the patterns above before and after you patch.
  5. Remove SD-WAN Manager's management interface from the open internet; restrict it to known, trusted hosts.
  6. If you find anything, open a Cisco TAC severity-3 case referencing the CVE with an admin-tech file (request admin-tech) attached.

CVSS/EPSS data as of 2026-10-06live record →