> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV - URL: https://f4n6.co.uk/security-feed/cisa-adds-exploited-cisco-catalyst-sd-wan-manager-auth-bypass-to-kev/ - Published: 2026-10-01T12:24:16.000Z - Updated: 2026-10-01T12:24:16.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-76504 ## 1\. Executive summary CISA added CVE-2026-76504, an authentication bypass in Cisco Catalyst SD-WAN Manager, to the Known Exploited Vulnerabilities catalog on 2026-09-30 after Cisco confirmed exploitation in the wild during September 2026\. The flaw is rated CVSS 9.8 CRITICAL and classified CWE-177; an unauthenticated remote attacker can send a crafted HTTP request to the API and obtain admin-user privileges. Cisco has published fixed releases and states there is no workaround, only network-level access restriction. Any EMEA financial services firm running an internet-facing Catalyst SD-WAN Manager instance should treat this as an emergency patch, because the exploited component is the management plane for the WAN estate and admin-level API access exposes configuration, policy and device control. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | DORA Art. 17 | Cisco confirmed active exploitation of CVE-2026-76504 in September 2026, and the flaw permits admin-level API access to a production network management component | The incident management process must cover this as an ICT-related incident: detection, triage, containment and root-cause handling for any exposed Catalyst SD-WAN Manager instance, not just a patch ticket | | DORA Art. 19 | Exploitation is confirmed in the wild against an internet-facing control component, so a compromise at a client is a reportable major ICT-related incident if it meets the classification thresholds | Clients must be able to report to their competent authority within the DORA timelines; the log sources named in §5 are the evidence base for that report | | NIS2 Art. 21(2)(d) | The vulnerable product is a network management platform that sits in the supply chain of managed WAN services many clients consume from third parties | Supply chain security measures must extend to confirming whether the client's SD-WAN provider or managed service runs an affected release and has patched it | DORA Art. 18 is engaged only once a client has an actual incident to classify; it is not triggered by the advisory alone. ## 3\. Technical analysis & attack chain CVE-2026-76504 is an API authentication bypass in Cisco Catalyst SD-WAN Manager caused by improper handling of URI encoding in an HTTP request. Cisco's advisory describes it as a hex encoding vulnerability; Rapid7 classifies the root cause as improper handling of URL encoding under CWE-177, and NVD's KEV entry uses the same CWE-177 classification. The affected product is Catalyst SD-WAN Manager, and the flaw applies regardless of system configuration. Confirmed attack chain: 1. The attacker identifies an internet-reachable Catalyst SD-WAN Manager instance. Cisco states that systems with ports exposed to the internet are at risk of compromise. 2. The attacker sends a crafted HTTP request to the API in which a single character in the request path is URI-encoded, bypassing an authentication rule for a specific API endpoint. Cisco's example is `POST /%6a_security_check HTTP/1.1`, where `%6a` is the URI-encoded form of the character `j`. Cisco states the attacker can encode any single character, so `%6a` is one instance of the technique, not the only one. 3. The bypass grants access to the API with the privileges of the admin user. No credentials and no prior access are required. 4. From that admin-level API position the attacker can act against the SD-WAN management plane. Cisco has not published detail on what the observed exploitation did after access was obtained. The exploitation activity itself is thinly documented. Cisco became aware of it in September 2026 and has not disclosed who is behind it, how many organisations were compromised, or when the first exploitation occurred. No threat actor is named in any source, and the VERIFIED REFERENCE DATA contains no MITRE ATT&CK profile for this activity, so attribution is unconfirmed. Do not attach an actor name to this CVE on the basis of this advisory. Two points of context matter for defenders. First, this is the latest in a run of authentication bypasses in the same product family: CVE-2026-20127 and Rapid7-discovered CVE-2026-20182 were critical unauthenticated peering authentication flaws in the vdaemon service earlier in 2026, and CVE-2026-20262 (path traversal) and CVE-2026-20245 (improper encoding or escaping of output) also reached KEV. CVE-2026-76504 targets a separate API authentication path from the vdaemon issues. Second, the KEV entry for CVE-2026-76504 carries a remediation due date of 2026-10-03 for US Federal Civilian Executive Branch agencies, two days after publication. That deadline is a US federal requirement; it is not a regulatory obligation on EMEA clients, but it is a reasonable indicator of urgency. Fixed releases, per Cisco: | Cisco Catalyst SD-WAN Software release | First fixed release | | -------------------------------------- | -------------------------- | | Earlier than 20.9 | Migrate to a fixed release | | 20.9 | 20.9.10.1 | | 20.12 | 20.12.8.2 | | 20.15 | 20.15.6.1 | | 20.18 | 20.18.4.1 | | 26.1 | 26.1.2.1 | | 26.2 | 26.2.1 | Cisco SD-WAN Cloud (Cisco Managed) is fixed in release 20.15.605 and Cisco states no customer action is required for that service. There is no workaround for on-premises deployments. Cisco's temporary mitigation is to prevent access to the system from unsecured networks: if internet access is required, restrict it to known trusted hosts and place Catalyst SD-WAN control components behind a filtering device. Cisco notes this mitigation is already in place in Catalyst SD-WAN Cloud Hosted environments, and states that organisations should apply updates even where the mitigation is deployed. ## 4\. Mitigation & containment P1, within 24 hours: - Inventory every Catalyst SD-WAN Manager instance, on-premises and provider-hosted, and record its software release against the fixed-release table in §3\. Treat any instance reachable from the internet as compromised-until-proven-clean, not merely vulnerable. - Upgrade affected on-premises instances to the first fixed release for their train (20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 or 26.2.1). Instances earlier than 20.9 must migrate to a fixed release. Do this outside the normal patch cycle. - Where the upgrade cannot be completed immediately, apply Cisco's temporary mitigation: block access to the management interface from unsecured networks and restrict it to known trusted hosts behind a filtering device. This is a stopgap, not a substitute for the upgrade. - Hunt the two log sources Cisco names, for the period from the start of September 2026 to now: - `/var/log/nms/containers/service-proxy/serviceproxy-access.log`: look for requests to `j_security_check` from unknown or unauthorised IP addresses, including requests with an encoded character in the path such as `POST /%6a_security_check HTTP/1.1`. Search for any single-character URI-encoded variant of the path, not only `%6a`. - `/var/log/nms/vmanage-server.log`: look for requests to `j_security_check` associated with usernames beginning with `viptela-reserved-`. - If either log shows a hit, treat the instance as compromised. Cisco customers can open a Severity 3 TAC case with CVE-2026-76504 in the title and supply an admin-tech file generated with the `request admin-tech` command. P2, within 72 hours: - Confirm with any managed SD-WAN provider whether the service the client consumes runs an affected release, and obtain written confirmation of the fixed release in use. This is the supply chain check in §2. - Rotate credentials and API tokens that were valid on any instance with a positive log hit, and review admin-level configuration changes made since the start of September 2026 for anything the client did not authorise. - Add the encoded-path pattern to edge and WAF logging so that future attempts against `j_security_check` are recorded even after patching. P3, within 7 days: - Review the estate for the other Catalyst SD-WAN CVEs in this family (CVE-2026-20127, CVE-2026-20182, CVE-2026-20262, CVE-2026-20245) and confirm each is remediated, since the same internet-facing control components are involved. - Fold the September 2026 exploitation window into the incident record that supports any DORA Art. 19 reporting decision. ## 5\. Indicators of compromise The sources provide no file hashes, domains, IP addresses or malware artefacts. What Cisco published is log-based behavioural guidance, reproduced below. | type | value | confidence | source | | -------------------- | ------------------------------------------------------------------------------------------- | ------------------------------------- | --------------------------------- | | log path | /var/log/nms/containers/service-proxy/serviceproxy-access.log | high (vendor-published) | Cisco via Rapid7, The Hacker News | | log path | /var/log/nms/vmanage-server.log | high (vendor-published) | Cisco via Rapid7, The Hacker News | | http request pattern | POST /%6a\_security\_check HTTP/1.1 (example; any single URI-encoded character in the path) | high (vendor-published, example only) | Cisco via Rapid7 | | username prefix | viptela-reserved- | high (vendor-published) | Cisco via Rapid7, The Hacker News | No atomic network or file indicators are available in the source material, so no copyable indicator block is provided. The values above are log-search patterns, not machine-pivotable atomic indicators. Behavioural indicators: | behaviour | where to observe | confidence | | ---------------------------------------------------------------------------------------------------------------- | ------------------------------------------ | -------------------------------------------------------------------------- | | Requests to j\_security\_check with a URI-encoded character in the path, from unknown or unauthorised source IPs | serviceproxy-access.log | high (vendor-published) | | Requests to j\_security\_check associated with usernames beginning viptela-reserved- | vmanage-server.log | high (vendor-published) | | Admin-level API activity on Catalyst SD-WAN Manager that the client did not initiate | Catalyst SD-WAN Manager audit and API logs | medium (inferred from the flaw's impact; not a vendor-published indicator) | ## 6\. Detection The sources give no file artefacts, so a YARA rule is not appropriate here. The usable material is HTTP request shape and log content, which suits a Sigma rule. The strings below are taken verbatim from Cisco's guidance as reproduced by Rapid7 and The Hacker News. ```yaml title: Cisco Catalyst SD-WAN Manager j_security_check URI-Encoding Auth Bypass Attempt (CVE-2026-76504) id: 7c1f4a92-3b6e-4d21-9a58-0e5d2c8b1f47 status: experimental description: Detects HTTP requests to j_security_check where a character in the path is URI-encoded, the technique used to bypass API authentication in CVE-2026-76504. Also detects j_security_check requests tied to the viptela-reserved- username prefix. author: Adverse Trace date: 2026-10-01 references: - https://www.rapid7.com/blog/post/etr-critical-cisco-catalyst-sd-wan-manager-api-authentication-bypass-exploited-in-the-wild-cve-2026-76504 - https://thehackernews.com/2026/10/cisa-adds-exploited-cisco-catalyst-sd.html logsource: category: webserver detection: selection_encoded_path: cs-uri-stem|re: '(?i)/%[0-9a-f]{2}_security_check' selection_plain_path: cs-uri-stem|endswith: '/j_security_check' selection_reserved_user: cs-username|startswith: 'viptela-reserved-' condition: selection_encoded_path or (selection_plain_path and selection_reserved_user) falsepositives: - Legitimate clients that percent-encode characters in the path for reasons unrelated to exploitation - Internal automation authenticating with a viptela-reserved- service account level: high ``` The `%6a` value in Cisco's example is one instance of the technique; the rule matches any single percent-encoded character in the path, which is the behaviour Cisco describes. Tune the `viptela-reserved-` clause against the client's own service accounts before enabling it at high severity, since that prefix is a legitimate reserved namespace. ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)**, 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-76504](https://nvd.nist.gov/vuln/detail/CVE-2026-76504?ref=f4n6.co.uk) | 9.8 Critical | ⚠ KEV 2026-09-30 | — | A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthentica… | ## 7\. Sources - Rapid7, "Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)", https://www.rapid7.com/blog/post/etr-critical-cisco-catalyst-sd-wan-manager-api-authentication-bypass-exploited-in-the-wild-cve-2026-76504 - The Hacker News, "CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV", 2026-10-01, https://thehackernews.com/2026/10/cisa-adds-exploited-cisco-catalyst-sd.html - NVD / CISA KEV, CVE-2026-76504, https://nvd.nist.gov/vuln/detail/CVE-2026-76504 - NVD / CISA KEV, CVE-2026-20182, https://nvd.nist.gov/vuln/detail/CVE-2026-20182 - NVD / CISA KEV, CVE-2026-20262, https://nvd.nist.gov/vuln/detail/CVE-2026-20262 - The Hacker News, "CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation", https://thehackernews.com/2026/06/cisa-adds-cisco-chrome-and-arista-flaws.html - ANSSI CERT-FR, "Vulnérabilité dans Cisco Catalyst SD-WAN", CERTFR-2026-AVI-0699, 2026-06-05, https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0699/ ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-76504 as CVSS 9.8 CRITICAL, CWE-177, and confirmed exploited in the wild, with a CISA KEV addition dated 2026-09-30\. The impact on EMEA financial services clients is concentrated in firms that expose Catalyst SD-WAN Manager to the internet, whether directly or through a managed provider: admin-level API access to the WAN management plane is a position from which an attacker can read and alter network policy across the estate, and Cisco has published no detail on what the observed exploitation did once access was obtained. The exploitation narrative, the actor and the victim count are single-sourced to Cisco's own statement and remain unconfirmed; no MITRE ATT&CK profile exists for this activity in our reference data, so we make no attribution. We will track vendor updates to the advisory, watch for any published post-exploitation detail or IOC set beyond the two log sources, and re-issue if Cisco or CISA adds technical indicators. Clients who cannot confirm a fixed release on every internet-facing instance within 24 hours should contact us to scope the exposure. --- [Read the original source →](https://thehackernews.com/2026/10/cisa-adds-exploited-cisco-catalyst-sd.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*