CVE-2026-76504: Cisco Catalyst SD-WAN Manager Auth Bypass (KEV)

CVE-2026-76504 is an authentication-bypass flaw (CWE-177, improper handling of URI encoding) in Cisco Catalyst SD-WAN Manager that lets a remote, unauthenticated attacker send a crafted HTTP request with an encoded character in the URI to slip past an access-control rule and reach the product's API with admin-user privileges, and Cisco's PSIRT says it became aware of active exploitation in September 2026 before the advisory was even published.

CVE-2026-76504 affects Cisco Catalyst SD-WAN Manager (formerly vManage), the centralized management controller for Cisco's SD-WAN fabric. NVD's description states the vulnerability "is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint," and that "a successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user" (NVD).

Cisco's own PSIRT submission is the only CVSS score NVD records for this CVE (NVD has not published a separate Primary score): CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, no privileges or user interaction needed (Cisco Security Advisory cisco-sa-sdwan-webauth-xr8beuuU). Cisco's own description notes the flaw affects SD-WAN Manager "regardless of system configuration" and that there are no workarounds — only upgrading remediates it, though Cisco also shipped an optional "Live Protect" virtual shield for temporary coverage while customers plan an upgrade.

Cisco's advisory states plainly: "In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." It gives concrete indicators of compromise for defenders: requests containing a URI-encoded character (the advisory's example uses %6a for j) sent to the j_security_check endpoint, visible in serviceproxy-access.log and vmanage-server.log, especially when associated with the internal viptela-reserved- service-account naming pattern from unexpected source IPs (Cisco Security Advisory cisco-sa-sdwan-webauth-xr8beuuU).

CISA added CVE-2026-76504 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-30, with a required-action due date of 2026-10-03 — a 3-day window reflecting the confirmed in-the-wild exploitation (CISA KEV).

Fixed releases are: 20.9.10.1 (for anything earlier than 20.9), 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1; Cisco's cloud-managed SD-WAN Cloud offering was separately fixed in Release 20.15.605 with no customer action required.

As of 2026-10-27, FIRST scores the probability of exploitation at 0.38928 (98.582th percentile) — among the highest EPSS scores of any advisory on this site, consistent with a KEV-listed, unauthenticated, admin-level API bypass with public exploitation already underway (FIRST EPSS).

Because there is no workaround and exploitation was already observed before the fix shipped, any internet-reachable SD-WAN Manager instance on an affected release should be upgraded immediately, audited against the published log indicators, and — if compromise is suspected — have its request admin-tech output reviewed with Cisco TAC.

• Improper handling of URI encoding (CWE-177) in API session-based authentication lets a remote unauthenticated attacker bypass an authentication rule and reach the API as the admin user. — NVD
• CVSS v3.1 base score 9.8 (vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is Cisco PSIRT's own CNA-submitted score (no separate NVD Primary score exists for this CVE); affects SD-WAN Manager regardless of configuration, no workaround available. — Cisco Security Advisory cisco-sa-sdwan-webauth-xr8beuuU
• Cisco PSIRT became aware of active exploitation in September 2026; gives log-based indicators of compromise (URI-encoded requests to j_security_check, viptela-reserved- service accounts). — Cisco Security Advisory cisco-sa-sdwan-webauth-xr8beuuU
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-30, required action due 2026-10-03. — CISA KEV
• EPSS score is 0.38928 (98.582th percentile) as of 2026-10-27. — FIRST EPSS