Cisco SD-WAN Manager Authentication Bypass Flaw Is Under Active Exploitation

Cisco SD-WAN Manager Faces Critical Authentication Bypass

Cisco has disclosed a critical vulnerability in Cisco Catalyst SD-WAN Manager that could allow an unauthenticated remote attacker to bypass authentication and access the management API with administrator privileges.

Tracked as CVE-2026-76504, the vulnerability has a CVSS 3.1 score of 9.8, placing it in the critical severity category. Cisco says the issue results from improper handling of URI encoding in HTTP requests.

The vulnerability is particularly significant because Cisco's Product Security Incident Response Team became aware of active exploitation in September 2026. Cisco has released fixed software and strongly recommends that affected customers upgrade as soon as possible.

There is no general workaround that fixes the underlying vulnerability.

Important: Organizations running Cisco Catalyst SD-WAN Manager should identify their software release, review the Cisco fixed-release table, inspect relevant logs, and prioritize remediation.

What Is CVE-2026-76504?

CVE-2026-76504 affects the API session-based authentication management of Cisco Catalyst SD-WAN Manager.

According to Cisco, the problem is caused by improper handling of URI encoding in an HTTP request. An attacker can send a specially crafted request to an affected API endpoint and bypass an authentication rule designed to restrict access.

A successful attack can provide access to the API as the admin user, even though the attacker does not have valid authentication credentials.

The CVE record classifies the issue under CWE-177, Improper Handling of URL Encoding (Hex Encoding). The CVSS vector indicates that the vulnerability is remotely exploitable, requires no privileges or user interaction, and can affect confidentiality, integrity and availability.

Why Authentication Bypass Matters

Authentication normally acts as the gatekeeper for administrative systems. In this case, Cisco says the vulnerable API authentication mechanism can be bypassed through specially crafted URI encoding.

This means the security boundary is not simply a matter of whether an attacker knows an administrator's password. The vulnerability can allow an attacker to reach the API without normal authentication.

Because Cisco Catalyst SD-WAN Manager is a management component, unauthorized administrative API access can represent a serious security concern for organizations using the platform.

Cisco has not disclosed the number of organizations affected by exploitation, the identities of attackers, or the specific actions taken after successful exploitation.

Additional details were not disclosed in the announcement.

Which Products Are Affected?

Cisco states that the vulnerability affects Cisco Catalyst SD-WAN Manager regardless of system configuration. The advisory does not list other products as affected.

The affected release trains and corresponding first fixed releases are:

Cisco also says the vulnerability has been addressed in Cisco SD-WAN Cloud, Cisco Managed Release 20.15.605. For that cloud-based service, Cisco says no user action is required and customers can check remediation status through the service GUI.

Organizations running versions earlier than 20.9 are instructed to migrate to a fixed release.

Cisco Reports Active Exploitation

The most important development is that this is not simply a newly disclosed theoretical vulnerability.

Cisco says its PSIRT became aware of active exploitation in September 2026. The company discovered the vulnerability while resolving a Cisco Technical Assistance Center support case.

Cisco's advisory was initially published on September 30, 2026. On October 2, Cisco updated it to version 1.1 with information about a Live Protect shield.

The active exploitation disclosure increases the importance of checking both software versions and potential signs of compromise.

What Indicators of Compromise Should Teams Check?

Cisco provides specific guidance for organizations investigating potentially compromised SD-WAN Manager systems.

The company says internet-exposed systems with exposed ports are at risk of exposure to compromise. Security teams should review logs for unexpected requests involving j_security_check.

One example provided by Cisco uses:

/%6a_security_check

Here, %6a represents an encoded character. Cisco emphasizes that this is only an example and that the vulnerability can involve other single encoded characters.

Log File 1: serviceproxy-access.log

Administrators should review:

/var/log/nms/containers/service-proxy/serviceproxy-access.log

Cisco recommends looking for entries related to j_security_check originating from unknown or unauthorized IP addresses.

Log File 2: vmanage-server.log

Teams should also review:

/var/log/nms/vmanage-server.log

Cisco specifically recommends checking for j_security_check requests associated with usernames beginning with:

viptela-reserved-

These entries need to be evaluated against the organization's normal network and operational activity because Cisco notes that some indicators can potentially occur during standard operations.

What Should Organizations Do?

Cisco's primary recommendation is straightforward: upgrade to a fixed software release.

The company says workarounds and mitigations should only be considered temporary measures. The permanent remediation is upgrading to a fixed version listed in the advisory.

For on-premises deployments, Cisco recommends restricting access from unsecured networks such as the public internet.

Where internet access is required, organizations should restrict access to known and trusted hosts and protect SD-WAN control components behind a filtering device such as a firewall.

Cisco also recommends:

• Monitor web traffic and logs for unexpected activity.

• Send logs to an external server where possible.

• Keep sufficient log history for investigation.

• Upgrade affected systems to fixed software.

• Replace default administrator passwords with stronger credentials.

• Restrict administrator accounts according to access requirements.

• Create individual operator accounts for administrators.

• Use certificates issued by a certificate authority when deploying SSL/TLS.

Organizations should evaluate the impact of any network access restriction before applying it because Cisco notes that mitigations can affect functionality or performance depending on the deployment.

Cisco Live Protect Shield Provides Temporary Coverage

Cisco's October 2 update adds information about a Live Protect shield for CVE-2026-76504.

The shield is intended to provide temporary security coverage while organizations plan their software upgrades. Cisco explicitly says the shield provides only temporary partial protection and that upgrading to the first fixed software release remains the remediation method.

Cisco also warns that applying the shield may prevent legitimate users whose requests contain URI encoding from logging in to SD-WAN Manager.

Organizations should therefore review the shield's limitations and evaluate its effect on their environment before deployment.

What If a Compromise Is Suspected?

Cisco recommends contacting its Technical Assistance Center if an organization needs help determining whether its SD-WAN Manager has been compromised.

The company asks customers to open a Severity 3 TAC case with CVE-2026-76504 in the title.

Before opening a case, Cisco recommends using the request admin-tech command from Cisco Catalyst SD-WAN Manager so that the resulting admin-tech file can be provided to Cisco TAC for analysis.

Security teams should preserve relevant logs and investigate suspicious activity rather than assuming that a software upgrade alone establishes whether previous unauthorized access occurred.

Cisco's advisory does not provide detailed information about the number of successful compromises or the actions performed by attackers after exploitation.

A Practical Response Checklist

For organizations operating Cisco Catalyst SD-WAN Manager, the response can be organized into five stages:

1. Identify

Determine whether your environment uses an affected Cisco Catalyst SD-WAN Manager release.

2. Check Exposure

Determine whether the management system or relevant ports are reachable from the internet or other unsecured networks.

3. Investigate

Review serviceproxy-access.log and vmanage-server.log for suspicious j_security_check activity and compare findings against expected network behavior.

4. Upgrade

Move to the appropriate fixed Cisco software release as soon as practical.

5. Escalate

If compromise is suspected, collect the requested diagnostic information and contact Cisco TAC with the CVE identifier.

What This Means for Network Security Teams

The vulnerability highlights the security importance of network management systems, particularly when administrative interfaces are accessible from untrusted networks.

The immediate technical issue is an authentication bypass caused by URI encoding handling. However, the broader operational lesson is the importance of combining rapid patching, restricted management access, centralized logging and post-exploitation investigation.

For enterprises, this could mean treating SD-WAN management infrastructure as a high-priority security asset rather than only as a networking component.

Cisco's advisory also demonstrates why vulnerability response should not stop at software version checks. When active exploitation has been reported, organizations need to consider both remediation and evidence of prior unauthorized activity.

The announcement highlights a broader industry shift toward faster response to vulnerabilities affecting centralized infrastructure management platforms.

Final Takeaway

CVE-2026-76504 is a critical authentication bypass affecting Cisco Catalyst SD-WAN Manager. Cisco rates the vulnerability at CVSS 9.8 and says it has been actively exploited.

The vulnerability can allow an unauthenticated remote attacker to access the affected API with administrator privileges. Cisco has released fixed software for supported release trains and says there is no workaround that addresses the underlying flaw.

Organizations using affected SD-WAN Manager deployments should verify their versions, review the supplied indicators of compromise, restrict unnecessary network exposure and upgrade to the appropriate fixed release.

Cisco's official advisory remains the authoritative source for affected versions, fixed releases and additional remediation guidance.