Cisco Catalyst SD-WAN Manager CVE-2026-76504: an unauthenticated path to the management API
A CVSS 9.8 authentication bypass in the SD-WAN control plane is being exploited in the wild. If the manager is reachable from the internet, treat it as a breach investigation, not a patch ticket.
Updated 2 October 2026 with the fixed cloud release, the indicators of compromise and the mitigation guidance from Cisco's advisory.
Cisco published an advisory on 30 September 2026 for CVE-2026-76504, an authentication bypass in Cisco Catalyst SD-WAN Manager, the platform formerly known as vManage. Cisco states that its PSIRT became aware of active exploitation in September 2026, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on the same day with a federal remediation deadline of 3 October 2026, a three-day window reserved for confirmed, active exploitation.
The vulnerability
The flaw is an authentication bypass caused by improper handling of URL encoding (CWE-177). It is rated CVSS 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. An unauthenticated remote attacker can reach the management API with administrator privileges, without valid credentials and without any user interaction.
The SD-WAN Manager is the control plane of the overlay network. Administrator access to it means the ability to read and change device configurations, push policies, inspect traffic flows and, in effect, re-architect the WAN of the victim organisation.
Fixed releases
| Release train | First fixed version |
|---|---|
| 20.9 | 20.9.10.1 |
| 20.12 | 20.12.8.2 |
| 20.15 | 20.15.6.1 |
| 20.18 | 20.18.4.1 |
| 26.1 | 26.1.2.1 |
| 26.2 | 26.2.1 |
| Cloud-hosted (managed) | 20.15.605 |
Releases earlier than 20.9 are not fixed and require migration to a supported train. Cisco is explicit that there are no workarounds for this vulnerability: Restricting access reduces exposure, but only the fixed release removes the flaw.
Why this is an incident response problem
SD-WAN managers are frequently reachable from the internet so that branch devices and administrators can connect. They are also managed by network teams rather than security teams, and they are seldom instrumented with endpoint detection. An attacker who gains administrative API access can be quiet: a new policy here, a mirrored flow there, a configuration backup exfiltrated for later use.
In Aureon's experience, control-plane compromises are discovered late and understood slowly because the forensic data lives in appliance logs and configuration histories that nobody reviews. The patch is the easy part.
Indicators of compromise
The bypass works by URI-encoding part of the request to the login handler so that the session checks are skipped. Cisco's advisory gives the concrete signature: Requests in which the string j_security_check appears partially encoded, for example as %6a_security_check, in serviceproxy-access.log. The second place to look is vmanage-server.log, where entries referencing reserved system accounts indicate that the bypass was used to act with built-in identities rather than a named administrator.
Both logs should be collected from the manager before it is upgraded, because the upgrade process can rotate or truncate them.
What to do now
- Patch to the fixed release for your train. Collect admin-tech files before upgrading so that evidence from the vulnerable period survives.
- Remove internet exposure. The manager should only be reachable through controlled paths: a management VPN, IP allow-listing or a dedicated out-of-band network. Cisco's own mitigations stress restricting internet access and applying firewall controls.
- Audit administrative activity. Search serviceproxy-access.log for encoded variants of j_security_check and vmanage-server.log for activity under reserved system accounts, then review API access logs, user and role changes, policy and template changes, and configuration pushes since the start of September. Compare device configurations against the intended baseline.
- Rotate credentials and certificates used by the manager and by integrations that trust it, and enforce strong administrator authentication.
- Deploy detection. Cisco has released Snort rule 67179 for this vulnerability. If you run intrusion detection in front of the manager, load it and review alerts retrospectively where packet captures exist.
A note for insurers and boards
A compromised WAN control plane can turn into business interruption across every site at once. If your portfolio or your organisation runs Catalyst SD-WAN, ask three questions this week: is the manager internet-reachable, has it been patched to the fixed release, and has anyone reviewed administrative activity for the exposure window. "We patched" answers only the second.
Sources
- Cisco Security Advisory: Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability (cisco-sa-sdwan-webauth-xr8beuuU)
- SOCRadar: CVE-2026-76504, Cisco SD-WAN Flaw Exploited
- SOC Prime: CVE-2026-76504 Cisco SD-WAN Authentication Bypass analysis
