Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)

1. Executive summary

Cisco published an advisory on 2026-09-30 for CVE-2026-76504, an unauthenticated remote API authentication bypass in Cisco Catalyst SD-WAN Manager rated CVSS 9.8 CRITICAL (CWE-177, improper handling of URL encoding). Cisco PSIRT states the flaw is exploited in the wild and became aware of the activity in September 2026; CISA added it to the KEV catalogue the same day with a remediation due date of 2026-10-03. Any internet-exposed Catalyst SD-WAN Manager instance is affected regardless of configuration, and Cisco has published no workaround, only fixed releases. For EMEA financial services, SD-WAN Manager is the management plane for the whole SD-WAN fabric, so a successful bypass hands an attacker admin-level API access to the control plane that carries branch, data-centre and partner traffic. The three-day KEV window is the operative deadline.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed steps, from Cisco's advisory as relayed by Rapid7:

1. An unauthenticated, remote attacker sends a crafted HTTP request to a specific API endpoint on Cisco Catalyst SD-WAN Manager.
2. The request encodes a single character in the URI. Cisco's example is POST /%6a_security_check HTTP/1.1, where %6a is the URI-encoded form of the character j. Cisco states any single character can be encoded, so %6a is illustrative, not the only working form.
3. The encoding causes the request to bypass an authentication rule for that endpoint. The attacker reaches the API with the privileges of the admin user.
4. Cisco PSIRT observed exploitation in the wild and became aware of it in September 2026. The advisory does not describe post-access activity, tooling, persistence or exfiltration for this CVE.

The vulnerability mechanism is improper handling of URL encoding (CWE-177). The affected product is Cisco Catalyst SD-WAN Manager, the management plane for the SD-WAN fabric. The flaw affects the product regardless of system configuration. Cisco has not published a workaround. The attack surface is the API endpoint reachable over HTTP; Cisco's guidance is framed around systems with ports exposed to the internet, and the temporary mitigation is to prevent access from unsecured networks or restrict access to known trusted hosts behind a filtering device.

CVE-2026-76504 is a distinct issue from the two earlier 2026 Catalyst SD-WAN authentication bypasses, CVE-2026-20127 and CVE-2026-20182, which Rapid7 describes as peering authentication flaws in the vdaemon service and similar parts of the networking stack. CVE-2026-76504 targets a separate API authentication path. Both earlier CVEs are in CISA KEV (added 2026-02-25 and 2026-05-14 respectively), both are CVSS 10.0 CRITICAL, and both are CWE-287 (improper authentication). Their EPSS scores are 88% and 92%. The recurrence of authentication bypasses in internet-facing Catalyst SD-WAN control components is the pattern to note: this is the third such flaw in the same product family in 2026.

Fixed releases for CVE-2026-76504:

Cisco addressed the flaw in the cloud-based Cisco SD-WAN Cloud (Cisco Managed) release 20.15.605 and states no customer action is required for that service.

Confidence caveats. The exploitation claim rests on Cisco PSIRT's statement as relayed by Rapid7; no independent telemetry confirming exploitation is present in the sources. No threat actor is named anywhere in the source material, so there is no attribution to make and none should be inferred. The post-compromise behaviour for CVE-2026-76504 is not described in any source; the detailed intrusion narrative in the related material belongs to CVE-2026-20245, a different vulnerability, and must not be read across to this CVE. The CVE-2026-20245 chain (unauthorised peering connection, SSH access via the vmanage-admin account, admin password change and reversion, upload of evil_tenant.csv, creation of a troot root account) is included here only as context for what a compromise of this product family can look like, and is single-sourced to Mandiant via The Register.

4. Mitigation & containment

P1 (within 24 hours)

• Inventory every Cisco Catalyst SD-WAN Manager instance and determine which are internet-reachable. Treat any internet-exposed instance as compromised until the log review below says otherwise.
• Upgrade to the fixed release for your train: 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 or 26.2.1. Instances earlier than 20.9 must migrate to a fixed release. Do this outside the normal patch cycle; the CISA KEV due date is 2026-10-03.
• Where an upgrade cannot be completed immediately, apply Cisco's temporary mitigation: block access to the system from unsecured networks, or restrict access to known trusted hosts and place the control components behind a filtering device. Apply the update even with the mitigation in place.
• Review /var/log/nms/containers/service-proxy/serviceproxy-access.log for requests carrying an encoded character in the j_security_check path, for example POST /%6a_security_check HTTP/1.1. Review /var/log/nms/vmanage-server.log for j_security_check requests associated with usernames beginning with viptela-reserved-. Cisco warns these entries also occur in normal operations, so correlate against expected source IPs before concluding compromise.
• If compromise is suspected, open a Severity 3 TAC case with CVE-2026-76504 in the title and supply an admin-tech file generated with the request admin-tech command.

P2 (within 72 hours)

• Confirm the Cisco Managed cloud estate is on release 20.15.605 or later; the vendor states no customer action is required there, but the version should be recorded for third-party risk evidence.
• Rotate credentials for admin and any viptela-reserved- accounts on systems that were internet-exposed before remediation, and review those accounts for changes made during the exposure window.
• Confirm no unexpected local accounts, scheduled tasks or configuration changes were created on the SD-WAN Manager during the exposure window.

P3 (within 7 days)

• Add CVE-2026-76504 to vulnerability management coverage; Rapid7 states Exposure Command, Vulnerability Management and Nexpose checks are expected in the October 1 content release.
• Review the estate against CVE-2026-20127 and CVE-2026-20182, both CVSS 10.0 and both in KEV, if that remediation is not already closed out.
• Restrict management-plane access to the SD-WAN fabric to a defined jump path and remove any standing internet exposure that is not operationally required.

5. Indicators of compromise

No atomic indicators (hashes, domains, IPs, filenames) are present in the source material. The sources describe observable behaviours only.

Behavioural indicators

6. Detection

The sources give distinctive log strings and a URI pattern, which is enough for a Sigma rule. No file artefacts, hashes or command lines are present, so no YARA rule is emitted.

title: Cisco Catalyst SD-WAN Manager j_security_check URI-encoded authentication bypass attempt
id: 8f2c1a44-7d3e-4b91-9c05-6a1e2f0d9b73
status: experimental
description: Detects HTTP requests to the j_security_check endpoint with a URI-encoded character in the path, consistent with CVE-2026-76504 exploitation against Cisco Catalyst SD-WAN Manager. Cisco notes these entries can also occur during normal operations; correlate with source IP reputation and expected management hosts.
author: Adverse Trace
date: 2026-09-30
references:

  - https://www.rapid7.com/blog/post/etr-critical-cisco-catalyst-sd-wan-manager-api-authentication-bypass-exploited-in-the-wild-cve-2026-76504
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|re: '(?i)/%[0-9a-f]{2}_security_check'
  selection_raw:
    cs-uri-query|contains: 'j_security_check'
  condition: selection_path or selection_raw
falsepositives:

  - Legitimate clients that percent-encode characters in the j_security_check path
  - Normal authentication traffic to the SD-WAN Manager API
level: high

title: Cisco Catalyst SD-WAN Manager j_security_check request for viptela-reserved account
id: 3b7d9e10-52a8-4c6f-b1d2-0e4a7c8f5a21
status: experimental
description: Detects j_security_check authentication requests associated with usernames beginning viptela-reserved-, which Cisco flags as a potential indicator of CVE-2026-76504 exploitation in the vmanage-server log.
author: Adverse Trace
date: 2026-09-30
references:

  - https://www.rapid7.com/blog/post/etr-critical-cisco-catalyst-sd-wan-manager-api-authentication-bypass-exploited-in-the-wild-cve-2026-76504
logsource:
  product: cisco
  service: sd-wan-manager
detection:
  selection:
    endpoint|contains: 'j_security_check'
    user|startswith: 'viptela-reserved-'
  condition: selection
falsepositives:

  - Reserved internal service accounts authenticating as part of normal platform operation
level: medium

CVE assessment

3 referenced CVEs — 3 actively exploited (CISA KEV), 3 critical (CVSS ≥ 9.0)

7. Sources

• Rapid7, "ETR: Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)", https://www.rapid7.com/blog/post/etr-critical-cisco-catalyst-sd-wan-manager-api-authentication-bypass-exploited-in-the-wild-cve-2026-76504, 2026-09-30
• NVD / CISA KEV, CVE-2026-76504, Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2026-76504
• NVD / CISA KEV, CVE-2026-20182, Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2026-20182
• NVD / CISA KEV, CVE-2026-20245, Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2026-20245
• ANSSI CERT-FR, "Vulnérabilité dans Cisco Catalyst SD-WAN", https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0699/, 2026-06-05
• Help Net Security, "Cisco discloses second exploited SD-WAN vulnerability in two weeks (CVE-2026-20262)", https://www.helpnetsecurity.com/2026/06/16/cisco-sd-wan-cve-2026-20262-exploited/, 2026-06-16
• The Register, "The hits keep on coming for Cisco vulnerabilities", https://www.theregister.com/security/2026/06/24/the-hits-keep-on-coming-for-cisco-vulnerabilities/5261797, 2026-06-24

8. Adverse Trace position

Adverse Trace assesses CVE-2026-76504 as CVSS 9.8 CRITICAL, in CISA KEV since 2026-09-30 with a remediation due date of 2026-10-03, and exploited in the wild per Cisco PSIRT. No actor is named in any source, so we make no attribution and treat any attribution circulating elsewhere as unconfirmed. The client impact is concentrated in firms running self-managed Catalyst SD-WAN Manager with internet-reachable management interfaces; those instances should be treated as compromised until the log review in §4 clears them, and the fixed-release upgrade should be run as an emergency change rather than scheduled. We will track the Cisco advisory for post-exploitation detail and any revision to the fixed-release matrix, and we will re-issue this note if a threat actor is named or if the KEV entry changes. Clients who cannot confirm their SD-WAN Manager exposure should contact their Adverse Trace handler today so we can scope the estate against the KEV deadline.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.