Cisco has disclosed a critical vulnerability in its Catalyst SD-WAN Manager after confirming that attackers are actively exploiting the flaw in the wild.
Tracked as CVE-2026-76504, the vulnerability affects the API session-based authentication mechanism in Cisco Catalyst SD-WAN Manager. Cisco rates the vulnerability as critical with a CVSS score of 9.8.
The company says an unauthenticated remote attacker could exploit the vulnerability to bypass authentication and access the affected system with the privileges of the administrator account.
What Is CVE-2026-76504?
CVE-2026-76504 is an authentication-bypass vulnerability caused by improper handling of URI encoding in an HTTP request. The flaw affects the API authentication process used by Cisco Catalyst SD-WAN Manager.
An attacker can send a specially crafted HTTP request to the affected API. According to Cisco, successful exploitation can bypass an authentication rule and provide access to the API as an administrator.
Because the attack does not require valid authentication credentials, organizations with exposed SD-WAN Manager systems face a significant security risk.
Cisco Confirms Active Exploitation
Cisco's Product Security Incident Response Team says it became aware of active exploitation of the vulnerability in September 2026.
The company has published indicators that administrators can use when investigating potentially compromised systems. Cisco specifically recommends checking serviceproxy-access.log and vmanage-server.log for suspicious requests associated with the authentication endpoint.
One example described by Cisco involves URI encoding in a request to the j_security_check endpoint. Administrators should compare suspicious entries against their normal network activity before treating individual log entries as confirmed evidence of compromise.
Internet-Exposed Systems Face Greater Risk
Cisco says Catalyst SD-WAN Manager systems exposed to the internet or with internet-facing ports are at risk of exposure to compromise.
The company recommends restricting access from unsecured networks and allowing only known and trusted hosts to reach SD-WAN control components where internet access is required.
Organizations can also place SD-WAN control components behind filtering infrastructure such as firewalls and monitor traffic to identify unexpected connections or requests.
No Workaround Is Available
Cisco states that there is no workaround that fully addresses CVE-2026-76504.
For on-premises deployments, Cisco recommends restricting access to the system from unsecured networks while organizations prepare and perform the software upgrade.
These restrictions should be evaluated against the organization's deployment requirements because changes to network access can affect normal SD-WAN functionality.
Cisco Releases Fixed Software
Cisco has released software versions that address the vulnerability across supported Catalyst SD-WAN release branches.
For the 20.9 release branch, the first fixed release is 20.9.10.1. For 20.12, the fixed release is 20.12.8.2, while 20.15 is fixed in 20.15.6.1.
Cisco lists 20.18.4.1 as the fixed release for the 20.18 branch, 26.1.2.1 for the 26.1 branch and 26.2.1 for the 26.2 branch. Releases earlier than 20.9 should be migrated to a fixed release.
Cisco also says the vulnerability has been addressed in Cisco SD-WAN Cloud Release 20.15.605. For the Cisco-managed cloud service, the company says no customer action is required for that remediation.
Organizations Should Investigate Before and After Patching
Applying the fixed software is an important remediation step, but organizations that operated potentially exposed systems should also consider whether unauthorized access occurred before the upgrade.
Security teams should review SD-WAN Manager logs for unexpected authentication activity, suspicious API requests, unknown source addresses and unexpected administrator-related events.
Cisco specifically recommends collecting the admin-tech file and contacting Cisco Technical Assistance Center if an organization needs help determining whether its SD-WAN Manager has been compromised.
Why This Vulnerability Matters
SD-WAN Manager is a management component rather than an ordinary endpoint application. Successful access to an administrative management interface can potentially provide an attacker with significant control over network infrastructure.
The combination of remote exploitation, authentication bypass, administrator-level access and confirmed exploitation makes CVE-2026-76504 particularly important for organizations operating affected SD-WAN Manager deployments.
The vulnerability also illustrates why management interfaces should not be unnecessarily exposed to the public internet and why network infrastructure needs the same vulnerability-management attention as servers, applications and employee devices.
What Administrators Should Do Now
Organizations using Cisco Catalyst SD-WAN Manager should identify their current software release and determine whether it is affected by CVE-2026-76504.
Administrators should upgrade to the appropriate fixed release recommended by Cisco and restrict exposure to unsecured networks while remediation is being completed.
Security teams should also review relevant logs for indicators described in Cisco's advisory and investigate suspicious activity that cannot be explained by normal operations.
If compromise is suspected, organizations should preserve relevant logs and system information before making changes that could destroy forensic evidence, and they can work with Cisco TAC for additional investigation support.
The Bigger Security Picture
The Cisco SD-WAN vulnerability is another example of why internet-facing network management systems are attractive targets for attackers.
Network infrastructure often provides privileged access to important parts of an organization's environment. A vulnerability in a management component can therefore have consequences beyond the vulnerable application itself.
For defenders, the incident reinforces the importance of reducing unnecessary internet exposure, maintaining current software versions, monitoring administrative interfaces and responding quickly when vendors confirm active exploitation.
With Cisco confirming exploitation and providing fixed releases, organizations running affected Catalyst SD-WAN Manager versions should treat the vulnerability as an active security issue rather than waiting for routine maintenance cycles.
