Skip to content
Today
Sign in

SecurityReports disagree12 publishers2 min readPublished Updated

Attackers reach admin on Cisco Catalyst SD-WAN Manager by encoding one URL character

Cisco says attackers are exploiting CVE-2026-76504, a 9.8-rated flaw that gives unauthenticated requests admin access to the Catalyst SD-WAN Manager API. Every configuration is affected, leaving exposed on-premises Managers needing an out-of-cycle upgrade and a check for earlier intrusion.

The Watch · Security desk

How we use AISend a correction

Illustration accompanying Attackers reach admin on Cisco Catalyst SD-WAN Manager by encoding one URL character
Generated illustration

What happened

  • Cisco's product security team learned of the exploitation during September, and the advisory with fixed releases followed on September 30.
  • Cisco lists no workaround; its interim step is to block access from unsecured networks or limit it to known hosts behind a filtering device, then patch anyway.
  • Signs of exploitation are encoded j_security_check requests in the service-proxy access log and viptela-reserved- usernames in vmanage-server.log.
  • BleepingComputer counts CVE-2026-76504 as the fifth Catalyst SD-WAN zero-day exploited in the wild since the start of 2026.

Why it matters

  • decision An internet-exposed on-premises Manager needs an out-of-cycle upgrade and a compromise review, because attackers had the bug before the fix shipped.
  • exposure A successful request lands admin API rights on the console that manages up to 6,000 SD-WAN devices, so one Manager puts the whole fabric it runs within reach.
  • contradiction Hunts keyed to the %6a string in BleepingComputer's report will miss requests that encode other characters, and Cisco says any single character works.
  • precedent Separate code paths in the same internet-facing component have failed this year, so keeping the Manager off open networks also limits exposure to the next bypass.

The fault is in the API's session-based authentication management [11]. "This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint," Cisco said [9]. No login is required. A crafted request from any network that can reach the Manager gets API access with the admin user's privileges [1]. The Manager, formerly vManage, is the dashboard that monitors and manages up to 6,000 SD-WAN devices [18].

Hunting needs care. BleepingComputer reported that threat actors are using %6a, the encoded letter j, in malicious requests [7]. Cisco's guidance, as Rapid7 relays it, treats %6a as one example and says encoding any single character in the request works [14]. A search for the literal string catches one variant. Cisco also says matching log entries can appear during standard operations and should be judged against normal network posture [14].

Rapid7 recommends upgrading on an emergency basis, outside normal patch cycles, and auditing affected systems for compromise because exploitation has already happened [6]. Cisco customers can open a Severity 3 TAC case with CVE-2026-76504 in the title and attach an admin-tech file produced by the request admin-tech command [12]. Rapid7 expected its own scanner checks in its October 1 content release [20].

Deployment type sets the workload. Cisco fixed its Cisco-managed SD-WAN Cloud service in release 20.15.605 and says those customers need take no action [8]. Cloud Hosted environments already sit behind the access filtering, and Cisco still says to apply updates where that filtering is in place [10]. Internet-exposed ports are what put a Manager at risk of compromise [15].

In early June, attackers used CVE-2026-20245 and CVE-2026-20262 to gain root on vulnerable SD-WAN systems [19]. Rapid7 also lists CVE-2026-20127 and CVE-2026-20182, unauthenticated peering flaws in the vdaemon service earlier this year, and notes that CVE-2026-76504 sits on a separate API authentication path [16]. In Rapid7's view, the recurrence of authentication bypasses in internet-facing Catalyst SD-WAN control components argues for emergency remediation [16]. Cisco did not share details of the attacks, so the public record does not show whether one group is behind this year's exploitation [13]. CISA has tagged 90 Cisco vulnerabilities as exploited since November 2021, four of them in Catalyst SD-WAN Manager and seven used by ransomware operations [21].

What to watch

  • Whether Cisco or other responders publish who is exploiting CVE-2026-76504 and how many Managers were hit.
  • Whether CISA adds CVE-2026-76504 to its catalog of exploited vulnerabilities.
  • Whether new Cisco indicators reach beyond j_security_check requests or link this activity to the June CVE-2026-20245 and CVE-2026-20262 attacks.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence85
Adoption
Insufficient
Hype gap+10
Incentives40
Confidence80

Perspective Coverage

12 publishers
Builder
Builder 14%
Operator
Operator 76%
Investor
Investor 10%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    The flaw results from improper handling of URL encoding (CWE-177); an unauthenticated, remote attacker can send a crafted HTTP request that bypasses an authentication rule for a specific API endpoint, gaining access to the API with the privileges of the admin user.

    ReportedSupportedSource: Rapid74 sources— create a free account to open themView cited source
  2. [2]

    According to Cisco, CVE-2026-76504 is being actively exploited in the wild; Cisco PSIRT became aware of the activity in September 2026.

    ReportedSupportedSource: Cisco via Rapid74 sources— create a free account to open themView cited source
  3. [3]

    On September 30, 2026, Cisco published a security advisory for CVE-2026-76504, a critical API authentication bypass in Cisco Catalyst SD-WAN Manager with a CVSSv3.1 score of 9.8.

    ReportedSupportedSource: Rapid7, citing Cisco advisory3 sources— create a free account to open themView cited source

Sources

12 independent publishers whose own reporting we read for this story.

  1. bleepingcomputer.com

    1 article · September 30, 2026

    Cisco warns of new SD-WAN zero-day exploited in attacks
  2. blog.rapid7.com

    1 article · September 30, 2026

    Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)
  3. cisa.gov

    1 article · September 30, 2026

    CISA Adds One Known Exploited Vulnerability to Catalog

  4. cisco.com

    1 article · October 3, 2026

    Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability - Cisco
  5. csoonline.com

    1 article · October 1, 2026

    Cisco SD-WAN Manager hit by zero-day admin access attack
  6. helpnetsecurity.com

    1 article · October 1, 2026

    New Cisco SD-WAN zero-day exploited in-the-wild (CVE-2026-76504)
  7. horizon3.ai

    1 article · September 30, 2026

    CVE-2026-76504 | Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability | Reversed by Horizon3
  8. infosecurity-magazine.com

    1 article · October 1, 2026

    Critical Cisco Catalyst SD-WAN Zero-Day Under Active Exploitation
  9. scworld.com

    1 article · October 1, 2026

    Cisco Catalyst SD-WAN Manager flaw added to CISA's exploit list
  10. securityaffairs.com

    1 article · October 1, 2026

    U.S. CISA adds Cisco Catalyst SD-WAN Manager flaw to its Known Exploited Vulnerabilities catalog
  11. securityweek.com

    1 article · October 1, 2026

    Cisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability
  12. thehackernews.com

    3 articles · October 1, 2026

    Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager

Share your take

Let Clarity write the post for you.

Signed-in readers get a short post drafted on this story in the register they choose — narrative, analytical, or a direct position — editable to the last word before it goes anywhere. The share buttons at the top of this story work without an account.

Create a free account to composeSign in

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

Loading related stories