Summary
On September 30, 2026, Cisco published advisory cisco-sa-sdwan-webauth-xr8beuuU for CVE-2026-76504, an authentication bypass in Cisco Catalyst SD-WAN Manager rated CVSS 9.8 (Critical). A remote attacker with no credentials can gain admin-level API access with a single crafted HTTP request — by percent-encoding one character in the request URI. Cisco’s own PSIRT confirmed the flaw was actively exploited in September 2026, discovered during a real TAC support case. CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a federal patch deadline of October 3. There are no workarounds. One SD-WAN Manager instance can administer up to 6,000 devices — so admin API access here reaches every branch office, every WAN edge, everything.
Severity
-
CVE ID: CVE-2026-76504
-
Title: Cisco Catalyst SD-WAN Manager authentication bypass vulnerability
-
CVSS 3.1: 9.8 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-
Weakness: CWE-177 — improper handling of URL encoding (hex encoding)
-
Attack requirements: None — unauthenticated, remote, single request
-
Exploited in the wild: Yes — confirmed by Cisco PSIRT, active exploitation in September 2026
-
CISA KEV: Added September 30, 2026 — federal deadline October 3
The vector is the maximum: network-accessible, low complexity, no privileges, no user interaction, full impact on confidentiality, integrity, and availability. A 9.8 that is both actively exploited and KEV-listed is the highest-priority class of vulnerability a defender will see this year.
Affected Versions
Cisco Catalyst SD-WAN Manager is affected regardless of configuration — there is no setting that avoids this. Fixed releases:
-
20.9 branch — fixed in 20.9.10.1
-
20.12 branch — fixed in 20.12.8.2
-
20.15 branch — fixed in 20.15.6.1 (cloud-hosted 20.15.605 was already fixed)
-
20.18 branch — fixed in 20.18.4.1
-
26.1 branch — fixed in 26.1.2.1
-
26.2 branch — fixed in 26.2.1
Releases earlier than 20.9 have no fix — you must migrate to a supported release. Check your version with the standard CLI/GUI version commands on the Manager; if the Manager is internet-reachable and below a fixed build, treat it as compromised until proven otherwise.
Technical Analysis
The one-character bypass. The root cause is CWE-177: improper handling of URL encoding in the API’s session-based authentication. Here is the mechanism, reconstructed from the advisory’s description. The authentication layer guards a sensitive endpoint — the j_security_check login-check path — with a filter that does a literal string match on the request URI. The attacker percent-encodes a single character of that path, for example sending %6a (the hex encoding of the letter “j”) instead of the literal “j”. The filter compares the raw, still-encoded string against its rule, finds no match, and waves the request through as if it needed no authentication. The backend then decodes the URI before routing, sees the real protected endpoint, and serves it — with the request now treated as privileged. Two components disagree about what the request is, and the attacker’s request slips through the gap between them.
Why this bug class never dies. Encoding-normalization mismatches are one of the oldest tricks in web security — directory traversal via %2e%2e, filter evasion via double-encoding, the classics. They keep recurring because the fix is architectural, not local: every layer that inspects a request must agree on the canonical form of that request before any security decision is made. A filter that matches on the raw string while the router decodes first is a design flaw, not a typo — and it survives code review because each component looks correct in isolation. Cisco shipping this in 2026, in the management plane of its flagship SD-WAN product, shows that even mature vendors still get canonicalization wrong at security boundaries.
Admin API access is total access. This is not a read-only leak or a limited privilege gain. The attacker lands with administrator-level API access to the SD-WAN Manager — the single pane of glass that provisions, monitors, and configures the entire SD-WAN fabric. One Manager can oversee up to 6,000 devices. From that position an attacker can push configuration to every branch router, harvest device credentials, alter routing policy to redirect traffic, or use the management network as a launchpad into the enterprise. The blast radius of one HTTP request is the whole WAN.
Found in a support case, not a lab. Cisco PSIRT became aware of active exploitation through a TAC support case — meaning a real customer, with a real incident, brought the evidence to Cisco. Exploitation-in-the-wild was not a theoretical forecast; it was already happening before the advisory existed. Combined with the CISA KEV listing on day one and a three-day federal patch deadline, the message to every other SD-WAN Manager operator is blunt: attackers already had this before you heard about it. The question is not whether your instance was probed, but whether it was exploited — and the detection guidance below is how you start answering that.
Detection: read the logs like an attacker. Cisco’s advisory points defenders at two log sources: serviceproxy-access.log and vmanage-server.log. Look for requests to j_security_check containing percent-encoded characters (such as %6a) arriving from unknown or unexpected IP addresses — that is the fingerprint of this bypass. Separately, watch for suspicious activity by internal service accounts, particularly ones named viptela-reserved-*, which attackers may abuse or impersonate after gaining access. If those logs are not retained or not centralized, fix that first — you cannot investigate an incident you cannot see. Note that legitimate traffic to these endpoints is rare, which makes the signal-to-noise ratio unusually favorable: encoded requests to the auth endpoint from unfamiliar sources are worth treating as hostile until proven otherwise.
Why This Matters
SD-WAN Manager is the control plane of the wide-area network. Compromising a control plane is categorically worse than compromising a single device, because the control plane defines what the network does. An attacker with admin API access does not need to hack 6,000 routers — they can simply ask the Manager to reconfigure them. And because this flaw needs no credentials and a single request, it is trivially scannable: every internet-exposed Manager on the planet could have been fingerprinted within days of disclosure.
This also fits this month’s grim pattern of broken access control in enterprise infrastructure — alongside the Exchange authorization flaw covered earlier this month. Different vendors, different products, same root story: the code that decides who is allowed keeps failing, and the failures keep being remotely exploitable.
Mitigation
-
Patch now — no workarounds exist. Upgrade to the fixed release on your branch (20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, or 26.2.1). If you are on a release earlier than 20.9, plan the migration immediately — there is no patch coming for those branches.
-
Assume breach if you were exposed. If your Manager was internet-reachable and unpatched at any point in September, do not just patch and move on. Audit serviceproxy-access.log and vmanage-server.log for encoded j_security_check requests from unknown IPs, and review activity by viptela-reserved-* service accounts.
-
Rotate credentials across the fabric. Admin API access can harvest device credentials and session material. Rotate Manager admin credentials, API tokens, and device credentials managed through the fabric — not just the Manager’s own password.
-
Restrict management-plane exposure. SD-WAN Manager has no business being broadly reachable from the internet. After patching, lock management access behind VPN or strict allow-lists. The next control-plane flaw should find no exposed target.
-
Meet the KEV deadline — then beat it. CISA’s federal deadline was October 3. If you are still unpatched, you are already past the line the US government drew for its own agencies. Treat that as the signal it is.
References
-
Cisco security advisory cisco-sa-sdwan-webauth-xr8beuuU — CVE-2026-76504 (published September 30, 2026)
-
CISA Known Exploited Vulnerabilities catalog — CVE-2026-76504 (added September 30, 2026)
-
NVD entry for CVE-2026-76504 (CWE-177)
Report by Faizan Akhtar — The Cyber Security Researcher