CVE-2026-76504 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-09-30

Added to CISA KEV: 2026-09-30 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL — IMMEDIATE ACTION: This vulnerability is actively exploited in the wild. Treat as an emergency patch. Cisco PSIRT has confirmed malicious activity; assume any unpatched internet-accessible SD-WAN Manager may already be compromised.
PATCH IMMEDIATELY: Upgrade Cisco Catalyst SD-WAN Manager to a fixed software release per Cisco Security Advisory cisco-sa-sdwan-webauth-xr8beuuU. No workaround exists — patching is the only effective mitigation.
INCIDENT RESPONSE: Review SD-WAN Manager API access logs for anomalous unauthenticated or unexpected admin-privileged API calls, especially to sensitive endpoints. Look for unexpected configuration changes, new admin accounts, or unusual tunnel/policy modifications.
NETWORK ISOLATION: If patching cannot be performed immediately, restrict access to the SD-WAN Manager API (TCP 443/8443) to known-good administrator IP addresses via firewall ACLs or security groups. Remove any public internet exposure of the management interface.
INTEGRITY CHECK: Audit all SD-WAN Manager configurations, administrator accounts, and API keys/tokens for unauthorised changes. Verify that no new admin accounts were created and no policy or routing changes were introduced.
MONITORING: Deploy alerts for any new admin account creation, API authentication failures followed by success, and unexpected configuration changes within SD-WAN Manager. Correlate with network flow data for unusual management plane traffic.
THREAT HUNTING: Search for HTTP requests to the SD-WAN Manager API with percent-encoded or hex-encoded characters in URI paths (e.g., %2F, %2e, double-encoding patterns) in web server access logs as indicators of exploitation attempts.
PATCH PRIORITY: P0/Critical — apply within 24 hours for internet-exposed instances; within 72 hours for all instances regardless of exposure. Do not wait for standard patch cycles.

🔍 Web Intelligence (Kagi · 2026-09-30)

Summary

CVE-2026-76504 is a critical authentication bypass vulnerability affecting the API session-based authentication management of Cisco Catalyst SD-WAN Manager. The flaw stems from improper handling of URI encoding in HTTP requests, which allows an unauthenticated, remote attacker to manipulate requests to bypass security rules. This vulnerability is significant because it enables unauthorized actors to gain administrative access to affected systems, posing a severe threat to the integrity and confidentiality of enterprise network infrastructure.

Exploitation

Active Exploitation: The vulnerability is currently being actively exploited in the wild, with Cisco PSIRT confirming malicious activity observed in September 2026 ^[1].
Threat Actors/Campaigns: While specific threat actor names have not been publicly attributed as of late September 2026, the ongoing campaign targets enterprise deployments ^[2].
Proof-of-Concept: There are no publicly available exploit tools or proof-of-concept code detailed in current security advisories, but the exploit mechanism is being utilized by attackers ^[2].
Attack Prerequisites: This is a remote, unauthenticated attack that does not require user interaction or valid credentials to execute ^[3].

Affected Products & Patches

Affected Versions: The vulnerability affects Cisco Catalyst SD-WAN Manager. Users should consult the official Cisco Security Advisory for specific version strings and impacted configurations ^[5].
Patch Availability: Cisco has released security updates to address this vulnerability; organizations are urged to apply these patches immediately to mitigate the risk of exploitation ^[2]^[4].
Mitigations: There are no documented workarounds; applying the vendor-provided software update is the only effective resolution ^[4].

Impact

Access and Capability: Successful exploitation allows an attacker to gain full administrative privileges within the Cisco Catalyst SD-WAN Manager, enabling them to control or reconfigure the network management environment ^[3].
Business Risk: For internet-facing deployments, this vulnerability presents an extreme risk, as it provides an entry point for remote actors to compromise sensitive network infrastructure, potentially leading to unauthorized data access, disruption of network services, or deep-level persistent access to corporate resources ^[1].

Sources

Critical Cisco Catalyst SD-WAN Manager API ...
According to Cisco, CVE-2026-76504 is being actively exploited in the wild; Cisco PSIRT became aware of the activity in September 2026. Cisco ...
Cisco warns of new SD-WAN zero-day exploited in attacks
Cisco released security updates to address a critical zero-day in the Catalyst SD-WAN Manager (tracked as CVE-2026-76504) that attackers are actively exploiting to escalate to admin privileges. ... CVE-2026-76504 is the fifth SD-WAN zero-day vulnerability actively exploited in the wild since the sta…
CVE-2026-76504 - Cisco Catalyst SD-WAN Manager System Account ...
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which…
Cisco Warns of Attackers Exploiting Critical Authentication ...
Attackers are exploiting CVE-2026-76504 to access Cisco SD-WAN Manager APIs as admin without credentials; fixed releases are available.
Cisco Catalyst SD-WAN Manager API Authentication ...
Cisco TAC cases should be opened as a Severity 3 with the CVE-ID CVE-2026-76504 in the title. Before opening a new TAC case, customers are ...

🔴 CVE-2026-76504