Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager

Cisco has disclosed that a newly found critical flaw in Catalyst SD-WAN Manager, tracked as CVE-2026-76504, is already being abused by attackers in real-world attacks. The bug, scoring 9.8 on CVSS, stems from improper handling of URI encoding in login-session requests, letting an unauthenticated attacker craft a request that slips past an access restriction on a single API endpoint and operate the Manager's API as the admin account, which carries the powerful netadmin role by default. Cisco's incident response team learned of the active abuse in September 2026 while reviewing a TAC support case, though it has not disclosed how many organizations were hit or who is behind the attacks. There is no workaround; fixed builds exist for every release train (for example 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1), and customers are urged to upgrade quickly, restrict internet exposure to the Manager, and check logs for suspicious j_security_check entries that may indicate compromise.