CVE-2026-76504: Critical Cisco SD-WAN Manager Zero-Day Exploited in the Wild

Cisco has disclosed another actively exploited zero-day vulnerability affecting its Catalyst SD-WAN infrastructure. The latest flaw, tracked as CVE-2026-76504, is a critical authentication bypass in Cisco Catalyst SD-WAN Manager that could enable an unauthenticated remote attacker to gain administrative access to an affected system.

The vulnerability carries a CVSS score of 9.8, with Cisco confirming active exploitation in September 2026. Given the central role SD-WAN Manager plays in controlling enterprise network infrastructure, successful exploitation could expose organizations to unauthorized administrative operations and potential network disruption.

According to BleepingComputer, this is the fifth actively exploited Cisco SD-WAN zero-day reported in 2026. On September 30, CISA also added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, requiring affected U.S. federal agencies to remediate it by October 3, 2026.

The growing number of vulnerabilities affecting enterprise network infrastructure highlights the importance of proactive threat detection, continuous security monitoring, and timely vulnerability management.

To Detect CVE-2026-76504 exploitation attempts, security teams can leverage the SOC Prime Platform to explore available vulnerability-focused detection content and accelerate threat hunting. The platform provides access to Sigma-based detection logic compatible with 40+ SIEM, EDR, and Data Lake technologies, helping organizations strengthen their defenses against emerging cyber threats.

Security professionals can also leverage Uncoder AI to streamline detection engineering, transform disclosed indicators into actionable hunting queries, validate detection logic, and translate rules across multiple security platforms.

Contact Sales

CVE-2026-76504 analysis

CVE-2026-76504 affects Cisco Catalyst SD-WAN Manager, formerly known as SD-WAN vManage, regardless of system configuration. The vulnerability resides in the software’s API session-based authentication management and results from improper handling of URI encoding within HTTP requests.

According to Cisco’s security advisory, the flaw is classified as CWE-177 (Improper Handling of URL Encoding). It allows a specially crafted HTTP request to bypass an authentication rule designed to restrict access to a specific API endpoint.

A remote attacker does not need valid credentials or prior authentication to exploit the issue. Successful exploitation grants access to the affected system’s API with the privileges of the admin user. By default, this account has the netadmin role, which permits all operations on the device.

This level of access creates substantial security risks because the compromised management interface could potentially be used to perform unauthorized administrative actions across the SD-WAN environment.

Cisco identified the vulnerability while resolving a Technical Assistance Center (TAC) support case. Its Product Security Incident Response Team (PSIRT) subsequently confirmed awareness of active exploitation during September 2026.

However, Cisco has not publicly attributed the attacks to a specific threat actor or disclosed the number of affected organizations. The two referenced reports also do not provide a CVE-2026-76504 PoC or sufficient information to reconstruct the complete exploitation chain.

Indicators of Compromise

Cisco has published CVE-2026-76504 IOCs associated with suspicious requests targeting the Manager’s session-based authentication mechanism.

One notable indicator involves URI encoding within the j_security_check authentication endpoint. For example, attackers can substitute the character j with its URI-encoded equivalent, %6a, producing the following request path:

/%6a_security_check

Importantly, Cisco clarifies that the vulnerability is not limited to this specific encoding pattern. Encoding another character within the request can also trigger the authentication bypass.

For CVE-2026-76504 detection, security teams should examine requests originating from unknown or unauthorized IP addresses:

• /var/log/nms/containers/service-proxy/serviceproxy-access.log
• /var/log/nms/vmanage-server.log

Particular attention should be paid to unusual j_security_check requests and related entries involving usernames beginning with viptela-reserved-.

These patterns may also occur during legitimate system operations, so defenders should correlate them with established network activity to minimize false positives.

Cisco’s official advisory provides additional technical details for CVE-2026-76504, including remediation instructions and examples of relevant log artifacts.

CVE-2026-76504 Mitigation

Cisco has released security updates addressing the authentication bypass vulnerability and strongly recommends upgrading affected Catalyst SD-WAN Manager deployments immediately.

There is currently no workaround that fully resolves the issue. Organizations should therefore prioritize patch deployment, particularly for management interfaces accessible from untrusted networks.

The following table summarizes the first fixed software releases published by Cisco:

Cisco has also addressed the vulnerability in its cloud-managed SD-WAN service with release 20.15.605. Customers using this Cisco-managed environment do not need to take additional remediation action.

For on-premises environments where immediate patching is not feasible, Cisco recommends applying temporary exposure-reduction measures:

• Restrict access to management interfaces from unsecured networks, including the public internet.
• Allow connections only from known, trusted hosts where remote access is necessary.
• Place SD-WAN control components behind appropriate firewall protections.
• Monitor web traffic for unexpected requests and retain security logs on an external system wherever possible.

These measures can reduce exposure but do not replace the security update.

If compromise is suspected, Cisco recommends collecting diagnostic information using the request admin-tech command and opening a Severity 3 TAC case with the vulnerability identifier in the title.

Security teams should also preserve relevant logs and investigate potentially unauthorized administrative activity. Applying the patch addresses the underlying flaw but should not be treated as proof that a previously compromised environment is clean.

Additionally, SOC Prime’s AI-Native Detection Intelligence Platform helps organizations strengthen their security posture by accelerating detection engineering, expanding threat visibility, and operationalizing intelligence against actively exploited vulnerabilities.