CVE-2026-76504

Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability

Exploited in the wild. In CISA KEV since 2026‑09‑30. Only a workaround so far.

CVSS 3.19.8Critical EPSS percentile78th1.8% chance in 30 days CISA KEVListedsince 2026-09-30, due 2026-10-03
Public exploit: 0 sources FixWorkaroundNo fixed build yet

Published 2026-09-30Updated 2026-10-03Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build is published yet. The vendor describes a workaround.

Cisco Catalyst SD-WAN ManagerAffected: 20.1.12Upgrade to: not statedAffected: 19.2.1Upgrade to: not statedAffected: 18.4.4Upgrade to: not statedAffected: 18.4.5Upgrade to: not stated + 411 more branchesStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you run Cisco Catalyst SD-WAN Manager and confirm its exact software version.
Determine if the management interface is reachable from the internet — this is the most urgent risk factor.
Upgrade to version 20.9.10.1 or later, which fixes this issue.
If you cannot upgrade immediately, apply the workaround steps in Cisco's security advisory to restrict access to the vulnerable API endpoint.
Review recent admin activity and API logs for signs of unauthorized access, since exploitation is already occurring.

Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

3 publishers

CISA added Cisco Catalyst SD-WAN Manager authentication bypass CVE-2026-76504 to the KEV catalog following reports of active exploitation.
as reported · Oct 1, 2026·The Hacker News summary
Cisco disclosed active exploitation of a zero-day authentication bypass (CVE-2026-76504) in Catalyst SD-WAN Manager, providing IoCs and fixes for affected versions.
as reported · Oct 1, 2026·Help Net Security summary
Cisco patched CVE-2026-76504, a critical authentication bypass in Catalyst SD-WAN Manager exploited in the wild, prompting CISA to add it to the KEV catalog.
as reported · Oct 1, 2026·SecurityWeek summary
Added to CISA KEV catalog
Sep 30, 2026·CISA KEV

Sourced from public security reporting — each date is when it was published, not when it happened. 4 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.

In plain language

Written by AI from the record

A critical flaw in Cisco Catalyst SD-WAN Manager lets attackers break in over the internet without any password and take full administrator control, and attackers are already doing this now — if you run this product, act immediately.

An unauthenticated attacker can bypass API authentication in Cisco Catalyst SD-WAN Manager by crafting an HTTP request with non-standard URI encoding that slips past a URL-matching authentication rule, gaining full admin-level API access; this is being actively exploited in the wild.

If you're affected

Full network admin takeover
Complete WAN configuration control
Data interception across sites
Operational disruption to all branches
Ransomware or backdoor deployment

What is it

Think of this like a hotel key-card system where the lock reader can be tricked by swiping a card formatted slightly differently — the door opens without checking anyone's identity. Here, a specially formatted web request tricks Cisco's SD-WAN management software into skipping the login check entirely, handing the attacker full administrator control over the network management system.

Who is affected

This matters to you if you run Cisco Catalyst SD-WAN Manager (also called Catalyst SD-WAN Manager) to manage your organization's wide-area network. It affects you whether or not attackers have any valid account, and the risk is highest if the management interface is exposed to the internet.

How urgent is it

Attackers are already exploiting this vulnerability in real-world attacks, and Cisco and CISA have both confirmed active exploitation as of late September 2026. CISA has set a remediation deadline of October 3, 2026, reflecting the severity and immediacy of the threat. This is not a theoretical risk — treat it as an active, ongoing attack scenario and remediate now.

What to do — in detail

Inventory all deployments of Cisco Catalyst SD-WAN Manager and record their exact software version.
Assess exposure: identify whether the management API/UI is reachable from the internet or only from trusted internal networks — internet-facing instances are the priority.
Upgrade to the fixed release, 20.9.10.1 or later, following Cisco's standard upgrade path for your current branch.
If immediate patching isn't possible, implement the access restrictions described in Cisco's advisory (cisco-sa-sdwan-webauth-xr8beuuU) to block the vulnerable API endpoint from untrusted sources.
Per CISA KEV guidance, this falls under BOD 26-04: remediate by October 3, 2026, or discontinue use of the product if mitigation is not possible; follow CISA's forensic triage requirements if compromise is suspected.
Review authentication logs, admin account activity, and configuration change history for signs of unauthorized access predating remediation, since exploitation has already been observed in the wild.
After patching, verify the fix by confirming the authentication bypass is no longer reproducible against the specific API endpoint referenced in the advisory.

Technical context

CVSS 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — no authentication or user interaction required, network-exploitable, full compromise of confidentiality, integrity, and availability. Weakness is CWE-177 (improper URI handling), allowing an attacker to craft a request with non-standard URI encoding that bypasses an authentication rule intended to restrict access to a specific API endpoint, granting admin-level API access. Listed in CISA's Known Exploited Vulnerabilities catalog since September 30, 2026, with confirmed active exploitation reported by Cisco and multiple news sources; a public exploit is available, indicating mature exploit tooling. CISA remediation deadline is October 3, 2026 under BOD 26-04. Fixed in Catalyst SD-WAN Manager 20.9.10.1; interim workaround available via Cisco's advisory.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS78th

Public exploit

CISA KEV

Listed as exploited in the wild since 2026-09-30.

US federal agencies must remediate by 2026-10-03.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

0 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

1.8% chance of exploitation activity in the next 30 days, which ranks it in the 78th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

12 events over 5 days, from the signal feeds we watch.

2026-10-05Analysis publishedOne Encoded Character Gets You Admin on Cisco's SD-WAN Manager. It's the Fifth Time That's Happened in 2026.
2026-10-03Workaround availablerecord updated
2026-10-01Workaround availablerecord updated
2026-09-30Added to CISA KEVworkaround available, published, weakness classified, record updated, record updated, record updated

Affected products

Ciscocommercial · USaka cisco systems inc., cisco systems
- Cisco Catalyst SD-WAN ManagerNetworking Infrastructure
- catalyst sd-wan managerNetworking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable