> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # CVE-2026-76504 Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability - URL: https://f4n6.co.uk/security-feed/cve-2026-76504-cisco-catalyst-sd-wan-manager-cisco-catalyst-sd-wan-manager-hex-encoding-vulnerability/ - Published: 2026-09-30T22:06:58.000Z - Updated: 2026-09-30T22:06:58.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-76504 ## 1\. Executive summary CVE-2026-76504 is a CVSS 9.8 critical authentication bypass in Cisco Catalyst SD-WAN Manager, caused by improper handling of URI encoding in an HTTP request (CWE-177). An unauthenticated, remote attacker can send a crafted request that bypasses the authentication rule on a specific API endpoint and reach it with the privileges of the admin user. Cisco PSIRT became aware of exploitation in the wild in September 2026, and the CVE was added to CISA KEV on 2026-09-30 with a remediation due date of 2026-10-03\. Any EMEA financial services firm running an internet-exposed Catalyst SD-WAN Manager instance should treat this as an emergency: the management plane controls the entire SD-WAN fabric, and there is no workaround. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | The vulnerability is under active exploitation and Cisco has published no workaround, so the incident management process must cover both emergency upgrade and compromise assessment on affected Catalyst SD-WAN Manager instances. | Incident response runbooks for the SD-WAN management plane need to be exercised now, not at the next scheduled test. | | DORA Art. 19 | CISA KEV lists a remediation due date of 2026-10-03, three days after issuance, for a system that is a control component of the network fabric. | If an affected instance is compromised, the major-incident reporting clock to the competent authority runs from detection, and the KEV deadline compresses the window to detect and remediate. | | NIS2 Art. 21(2)(d) | Catalyst SD-WAN Manager is a network management component, and the same product family has had three separate exploited authentication or file-write flaws in 2026 (CVE-2026-20182, CVE-2026-20245, CVE-2026-20262). | Supply chain security measures should cover how this vendor's control-plane components are exposed, patched and monitored, not just the individual CVE. | ## 3\. Technical analysis & attack chain Confirmed steps, from Cisco's advisory as relayed by Rapid7: 1. The attacker sends a crafted HTTP request to an affected Catalyst SD-WAN Manager instance over the network. No authentication is required. 2. The request encodes a single character in the URI path. Cisco's example is `POST /%6a_security_check HTTP/1.1`, where `%6a` is the URI encoding of the character `j`. Any single character in the request can be encoded, not just this one. 3. The encoded path bypasses the authentication rule that would normally apply to the `j_security_check` endpoint, and the request reaches the API with the privileges of the admin user. 4. Cisco observed exploitation in the wild; PSIRT became aware of the activity in September 2026. The flaw is classified CWE-177 (improper handling of URL encoding). Rapid7's write-up describes the same issue as an API authentication bypass and notes the CVSSv3.1 score of 9.8, which matches the verified reference data. The affected product is Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, the management plane for the SD-WAN fabric. The vulnerability affects the product regardless of system configuration. Cisco has published no workaround. The two log sources Cisco directs defenders to are the ones that matter for triage: - `/var/log/nms/containers/service-proxy/serviceproxy-access.log`: look for requests carrying an encoded character in the `j_security_check` path, for example `POST /%6a_security_check HTTP/1.1`. - `/var/log/nms/vmanage-server.log`: look for requests to `j_security_check` associated with usernames beginning with `viptela-reserved-`. The `%6a` value is an example only. Because any single character can be encoded, a detection rule that greps for `%6a` alone will miss variants; the reliable signal is an encoded character anywhere in the `j_security_check` path. Fixed releases, per Cisco via Rapid7: | Cisco Catalyst SD-WAN Software release | First fixed release | | -------------------------------------- | -------------------------- | | Earlier than 20.9 | Migrate to a fixed release | | 20.9 | 20.9.10.1 | | 20.12 | 20.12.8.2 | | 20.15 | 20.15.6.1 | | 20.18 | 20.18.4.1 | | 26.1 | 26.1.2.1 | | 26.2 | 26.2.1 | Cisco addressed the issue in the cloud-based Cisco SD-WAN Cloud (Cisco Managed) release 20.15.605 and states that no customer action is required for that service. Context on the product family, from the related sources: Catalyst SD-WAN Manager was affected by two earlier critical unauthenticated peering authentication flaws in 2026, CVE-2026-20127 and Rapid7-discovered CVE-2026-20182, both in the `vdaemon` service and similar parts of the networking stack. CVE-2026-76504 targets a separate API authentication path. CVE-2026-20245 (improper encoding or escaping of output, authenticated local attacker, arbitrary command execution as root) and CVE-2026-20262 (path traversal, authenticated remote attacker, file creation or overwrite) are also in CISA KEV with 2026 due dates. Those are separate CVEs and separate mechanisms; they are relevant here only as evidence that this management plane is a recurring target. Unconfirmed and single-sourced material. The exploitation-in-the-wild claim rests on Cisco's own statement, relayed by Rapid7; no independent telemetry is provided in the sources. No threat actor is named in any source, and the verified reference data contains no MITRE ATT&CK profile for this activity, so attribution is unconfirmed. The sources do not describe post-exploitation behaviour, persistence, command-and-control, lateral movement or data access, and this advisory does not speculate about them. CISA KEV records "Known ransomware campaign use: Unknown" for this CVE; nothing in the sources links it to ransomware. ## 4\. Mitigation & containment P1, within 24 hours: - Upgrade every internet-exposed Catalyst SD-WAN Manager instance to the fixed release for its train from the table in §3\. Rapid7 recommends doing this on an emergency basis, outside the normal patch cycle. There is no workaround, so the upgrade is the remediation. - Where an instance cannot be upgraded immediately, restrict access so that only known, trusted hosts can reach it, and place the control components behind a filtering device. Cisco states this mitigation is already deployed in Catalyst SD-WAN Cloud Hosted environments. Apply the upgrade anyway once it is available. - Hunt the two log files named in §3 for encoded characters in the `j_security_check` path and for `j_security_check` requests tied to `viptela-reserved-` usernames. Treat any hit as suspected compromise. - If compromise is suspected, Cisco customers can open a Severity 3 TAC case with CVE-2026-76504 in the title and supply an admin-tech file generated with the `request admin-tech` command. P2, within 72 hours: - Complete the upgrade across instances that are not internet-facing but are reachable from untrusted network segments. - Confirm the Cisco SD-WAN Cloud (Cisco Managed) service is on release 20.15.605 or later; Cisco states no customer action is required for that service, so this is verification rather than remediation. - Enable the Rapid7 exposure checks for CVE-2026-76504 in the October 1 content release if you run Exposure Command, Vulnerability Management or Nexpose, and reconcile the results against your own asset inventory rather than trusting either list alone. P3, within 7 days: - Review how the SD-WAN management plane is exposed. The recurrence of authentication bypasses in internet-facing Catalyst SD-WAN control components is the reason to treat direct internet exposure of the manager as a standing architectural finding, not a one-off. - Confirm that the log sources in §3 are being shipped to whatever platform you use for detection, and that retention covers the period since at least September 2026 so retrospective hunting is possible. ## 5\. Indicators of compromise No atomic indicators (hashes, domains, IP addresses, file names) are present in the source material. The sources describe observable request patterns and log locations only. | type | value | confidence | source | | ---- | ----------------------------------------------------- | ---------- | ------ | | n/a | No atomic indicators available in the source material | n/a | n/a | Behavioural indicators: | behaviour | where to observe | confidence | | ---------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | -------------------------------------- | | HTTP request with an encoded character in the j\_security\_check path, for example POST /%6a\_security\_check HTTP/1.1 | /var/log/nms/containers/service-proxy/serviceproxy-access.log | High, from Cisco's advisory via Rapid7 | | Requests to j\_security\_check associated with usernames beginning with viptela-reserved- | /var/log/nms/vmanage-server.log | High, from Cisco's advisory via Rapid7 | The `%6a` example is one instance of the pattern; any single encoded character in the path is in scope. Detection logic should match the encoded-character pattern, not the literal string. ## 6\. Detection The sources give a distinctive request pattern and a username prefix, which is enough for a Sigma rule. There are no file artefacts, so no YARA rule is emitted. ```yaml title: Cisco Catalyst SD-WAN Manager j_security_check Authentication Bypass Attempt (CVE-2026-76504) id: 8f3c1a72-4d5e-4b90-9c11-7a2e6f0d3b84 status: experimental description: Detects HTTP requests to the j_security_check endpoint where a character in the path is URI-encoded, which bypasses the authentication rule on that endpoint in Cisco Catalyst SD-WAN Manager (CVE-2026-76504). Also detects j_security_check requests tied to viptela-reserved- usernames. author: Adverse Trace date: 2026-09-30 references: - https://www.rapid7.com/blog/post/etr-critical-cisco-catalyst-sd-wan-manager-api-authentication-bypass-exploited-in-the-wild-cve-2026-76504 - https://nvd.nist.gov/vuln/detail/CVE-2026-76504 logsource: category: webserver detection: selection_encoded_path: cs-uri-stem|re: '(?i)/%[0-9a-f]{2}_security_check' selection_reserved_user: cs-uri-query|contains: 'viptela-reserved-' condition: selection_encoded_path or selection_reserved_user falsepositives: - Legitimate clients that percent-encode characters in the path for reasons unrelated to exploitation. Validate against the source IP and the requesting user. level: critical ``` The rule targets the URI path and query fields. If your log pipeline normalises percent-encoding before indexing, the `selection_encoded_path` branch will not fire and you will need to match on the raw request line instead; the `viptela-reserved-` branch is unaffected by normalisation. ## CVE assessment 1 referenced CVE — **1 actively exploited (CISA KEV)**, 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-76504](https://nvd.nist.gov/vuln/detail/CVE-2026-76504?ref=f4n6.co.uk) | 9.8 Critical | ⚠ KEV 2026-09-30 | — | A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthentica… | ## 7\. Sources - Rapid7, "Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)", https://www.rapid7.com/blog/post/etr-critical-cisco-catalyst-sd-wan-manager-api-authentication-bypass-exploited-in-the-wild-cve-2026-76504 - NVD, "CVE-2026-76504", https://nvd.nist.gov/vuln/detail/CVE-2026-76504, published 2026-09-29 - CISA Known Exploited Vulnerabilities, "CVE-2026-20245", https://nvd.nist.gov/vuln/detail/CVE-2026-20245 - CISA Known Exploited Vulnerabilities, "CVE-2026-20182", https://nvd.nist.gov/vuln/detail/CVE-2026-20182 - CISA Known Exploited Vulnerabilities, "CVE-2026-20262", https://nvd.nist.gov/vuln/detail/CVE-2026-20262 - BleepingComputer, "Cisco warns of unpatched SD-WAN zero-day exploited in attacks", https://www.bleepingcomputer.com/news/security/new-cisco-sd-wan-flaw-exploited-in-zero-day-attacks-to-gain-root/ - Help Net Security, "Cisco discloses second exploited SD-WAN vulnerability in two weeks (CVE-2026-20262)", https://www.helpnetsecurity.com/2026/06/16/cisco-sd-wan-cve-2026-20262-exploited/ ## 8\. Adverse Trace position CVE-2026-76504 is a CVSS 9.8 critical unauthenticated authentication bypass in the management plane of the SD-WAN fabric, it is in CISA KEV as of 2026-09-30 with a 2026-10-03 due date, and Cisco has confirmed exploitation in the wild with no workaround available. The exploitation claim is single-sourced to Cisco via Rapid7 and no actor is named, so we treat attribution as unconfirmed; the severity and KEV status are not in question. For EMEA financial services clients, the exposure that matters is any Catalyst SD-WAN Manager instance reachable from the internet, because admin-level API access to that component is admin-level access to the network fabric. We will track the fixed-release table for changes, watch for any vendor or third-party reporting that names an actor or describes post-exploitation behaviour, and reissue this advisory if either appears. Clients who cannot confirm the patch state of an internet-facing instance within 24 hours should contact us to scope a compromise assessment against the two log sources in §3. --- [Read the original source →](https://nvd.nist.gov/vuln/detail/CVE-2026-76504?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*