CVE-2026-76504

Published Sep 30, 2026

Last updated 15 days ago

API

Cisco Catalyst SD-WAN Manager

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-76504 is an API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager. The issue arises from the improper handling of URI/URL encoding in HTTP requests. An unauthenticated, remote attacker can exploit this flaw by sending a crafted HTTP request to the affected system's API. This allows the request to bypass an authentication rule designed to restrict access to a specific API endpoint, granting the attacker access to the API with administrative privileges without requiring any credentials. The vulnerability affects Cisco Catalyst SD-WAN Manager regardless of its system configuration. Cisco discovered the issue through a customer support case and confirmed that it is being actively exploited in the wild. Consequently, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76504 to its Known Exploited Vulnerabilities (KEV) catalog on September 30, 2026. Cisco has released software updates to address the flaw, and because no workarounds are available, organizations are advised to apply the patches to secure their systems.

Description: A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.
Source: psirt@cisco.com
NVD status: Analyzed
Products: catalyst_sd-wan_manager

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
Exploit added on: Sep 30, 2026
Exploit action due: Oct 3, 2026
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

psirt@cisco.com: CWE-177

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "77568CB9-9932-4E34-80AE-8F3907FD1108",
            "versionEndExcluding": "20.9.10.1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "0718434D-8D5C-4C3B-9A5A-E51E00FAF08E",
            "versionEndExcluding": "20.12.8.2",
            "versionStartIncluding": "20.12",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A18803AF-4543-48CF-B285-491D299B9E4F",
            "versionEndExcluding": "20.15.6.1",
            "versionStartIncluding": "20.15",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "2C2E5FDB-3377-486E-A162-CC41CEDD6407",
            "versionEndExcluding": "20.18.4.1",
            "versionStartIncluding": "20.18",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "C3146F9A-A6CB-43C0-83D5-65E86E733459",
            "versionEndExcluding": "26.1.2.1",
            "versionStartIncluding": "26.1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:26.2:*:*:*:*:*:*:*",
            "matchCriteriaId": "AF723B33-8BE6-4A8D-B156-28CC3EB3A87B",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.