CVE-2026-76504: 
Cisco SD-WAN Catalyst Manager vulnerability analysis and mitigation

CVE-2026-76504 is a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager's API session-based authentication management. The flaw allows unauthenticated, remote attackers to access affected systems with full admin-level privileges by sending a crafted HTTP request with improper URI encoding. It was publicly disclosed on September 30, 2026, and affects Cisco Catalyst SD-WAN Manager across a wide range of versions (earlier than 20.9.10.1, 20.12 before 20.12.8.2, 20.15 before 20.15.6.1, 20.18 before 20.18.4.1, 26.1 before 26.1.2.1, and 26.2). The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (Cisco Advisory, CISA KEV).

The root cause is classified as CWE-177 (Improper Handling of URL Encoding / Hex Encoding). The SD-WAN Manager API applies an authentication rule to restrict access to a specific endpoint (e.g., j_security_check); however, when a character in the URI path is percent-encoded (e.g., j encoded as %6a), the authentication rule fails to match the request, allowing it to bypass the access control entirely. An attacker exploits this by sending a crafted HTTP POST request to the encoded endpoint path (e.g., /%6a_security_check) without any credentials. No authentication, special privileges, or user interaction is required — the attack is fully network-accessible and automatable (Cisco Advisory, Rapid7 ETR). The attack pattern aligns with CAPEC-64 (Using Slashes and URL Encoding Combined to Bypass Validation Logic) and CAPEC-72 (URL Encoding).

Successful exploitation grants an unauthenticated remote attacker full administrative access to the Cisco Catalyst SD-WAN Manager API, enabling them to perform any action available to the admin user — including modifying SD-WAN policies, accessing sensitive network configuration data, creating or deleting users, and potentially pivoting to managed SD-WAN edge devices across the enterprise network. The confidentiality, integrity, and availability of the entire SD-WAN infrastructure are all fully compromised. Given that SD-WAN Manager serves as the centralized controller for enterprise WAN deployments, a successful attack could result in widespread network disruption, data exfiltration, and lateral movement across connected branch sites (Cisco Advisory, Rapid7 ETR).

Active exploitation in the wild was confirmed by Cisco PSIRT in September 2026, and the vulnerability was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on September 30, 2026, with a remediation due date of October 3, 2026 for federal agencies (CISA KEV). The NVD SSVC assessment classifies exploitation as "active" and the vulnerability as "automatable" with "total" technical impact. A GitHub repository (ShadowForge-Cyber/CVE-2026-76504-Proof-of-concept) claiming to be a PoC was identified but assessed as a fake claim with no actual exploit code — it solicits private access via email (Feedly). The EPSS score is approximately 0.018 (1.8%), though real-world exploitation has been confirmed. No specific threat actor attribution has been publicly disclosed, and its potential use in ransomware campaigns is listed as "Unknown" by CISA (CISA KEV).

1. Reconnaissance: Identify internet-facing Cisco Catalyst SD-WAN Manager instances using tools like Shodan or Censys, searching for exposed management interfaces (typically on port 443 or 8443). Confirm the version is vulnerable (prior to fixed releases).
2. Identify the target endpoint: The authentication bypass targets the j_security_check API endpoint used for session-based login on the SD-WAN Manager.
3. Craft the malicious HTTP request: Construct an HTTP POST request where the j character in the endpoint path is percent-encoded (e.g., /%6a_security_check). Any single URI-encoded character that causes the authentication rule to fail to match will trigger the bypass.
4. Send the request: Transmit the crafted POST request to the target SD-WAN Manager API (e.g., POST /%6a_security_check HTTP/1.1). No credentials are required.
5. Gain admin API access: The server processes the request, bypasses the authentication rule due to the URI encoding mismatch, and grants the attacker a session with admin-level privileges.
6. Post-exploitation: With admin API access, the attacker can enumerate and modify SD-WAN policies, extract credentials or configuration data, create backdoor admin accounts, or issue commands to managed SD-WAN edge devices to facilitate lateral movement across the enterprise WAN (Cisco Advisory, Rapid7 ETR).

• Network: Unexpected HTTP POST requests to URI-encoded variants of j_security_check (e.g., /%6a_security_check, /%6A_security_check) from unknown or unauthorized external IP addresses; unusual API activity originating from non-administrative source IPs.
• Logs (serviceproxy-access.log): Entries at /var/log/nms/containers/service-proxy/serviceproxy-access.log showing POST requests to percent-encoded paths such as /%6a_security_check with HTTP 200 responses from untrusted IPs. Example: "POST /%6a_security_check HTTP/1.1" 200
• Logs (vmanage-server.log): Entries at /var/log/nms/vmanage-server.log referencing j_security_check with usernames beginning with viptela-reserved- from unauthorized sources. Example: Request Stored in Map is (/%6a_security_check) for user (viptela-reserved-..)
• Authentication Events: Unexpected admin-level API sessions or configuration changes not correlated with known administrator activity; new admin accounts created without authorization.
• Configuration Changes: Unexpected modifications to SD-WAN policies, routing configurations, or user accounts that cannot be attributed to legitimate administrative actions (Cisco Advisory).

Cisco has released fixed software versions and confirms no workarounds fully address this vulnerability. The fixed releases are: 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1. Versions earlier than 20.9 must migrate to a supported fixed release. Cisco also released a temporary "Live Protect" shield for CVE-2026-76504 that provides partial protection while upgrade planning occurs, but notes it may prevent legitimate users with URI-encoded credentials from logging in. As a network-level mitigation for on-premises deployments, restrict access to the SD-WAN Manager from unsecured networks (e.g., the internet) and limit access to known, trusted hosts using a firewall. Cisco SD-WAN Cloud Hosted environments have already received the mitigation. CISA's due date for federal agencies was October 3, 2026 (Cisco Advisory, CISA KEV).

Cisco's PSIRT confirmed active exploitation in September 2026 and disclosed the vulnerability on September 30, 2026, noting it was discovered during resolution of a TAC support case (Cisco Advisory). Rapid7 published an emergency threat response (ETR) blog post highlighting the critical nature of the flaw and its active exploitation (Rapid7 ETR). BleepingComputer, The Hacker News, SecurityWeek, Infosecurity Magazine, and Help Net Security all covered the vulnerability prominently, emphasizing the lack of a workaround and the urgency of patching (BleepingComputer). ITNews noted Cisco's statement that no workaround exists, drawing significant attention from network administrators. Community discussion on Reddit (r/SecOpsDaily, r/linuxadmin) and Mastodon/Bluesky was active, with security professionals urging immediate patching given the CISA KEV listing and 24-hour federal remediation deadline (CISA KEV).