CVE-2026-76504: Cisco's SD-WAN Manager Zero-Day Was Found During a Routine Support Case

Cisco disclosed CVE-2026-76504 on September 30, 2026. It is a CVSS 9.8 authentication bypass in Catalyst SD-WAN Manager that lets a remote, unauthenticated attacker gain full admin-level API access. Cisco's PSIRT found the bug while resolving a customer support case, not through a bug bounty or external report, and confirmed active exploitation before the advisory went out. CISA added it to the Known Exploited Vulnerabilities catalog the same day, and Cisco has no workaround to offer, only patching and network restrictions.

How the Authentication Bypass Works

The flaw sits in SD-WAN Manager's API session authentication and is tracked as CWE-177, improper handling of URL encoding. The login flow runs requests through a filter tied to the j_security_check endpoint. Cisco found that encoding a single character in that request path, such as %6a for the letter j, lets the request slip past the filter's string match while the application server still decodes and routes it correctly. The result is a request that never passes the authentication check but still reaches the backend with administrator privileges. Cisco noted that encoding almost any single character in the path can trigger the same bypass, which is why there is no narrow pattern to block at the edge.

Who's Affected

The bypass affects every deployment of Catalyst SD-WAN Manager, on-prem or cloud-hosted, regardless of configuration. Fixed releases are 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1, each one patching the branch it belongs to. Cisco-hosted cloud instances were remediated automatically through Release 20.15.605. NVD rates the bug 9.8 critical under CVSS 3.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network-reachable, low complexity, no privileges or user interaction needed, and full compromise of confidentiality, integrity, and availability. Cisco has not published a workaround. The only mitigation short of patching is restricting network access to the SD-WAN Manager management interface.

A Bug Cisco's Own Support Team Found First

Field reporting citing BleepingComputer's count puts CVE-2026-76504 as the fifth Cisco SD-WAN zero-day actively exploited in the wild this year, part of a pattern that has made SD-WAN Manager one of the most watched edge products of 2026. What sets this one apart is how it surfaced. Cisco did not learn about it from a research disclosure or a honeypot catching scanning traffic. Its own engineers found the authentication bypass while resolving a customer's technical assistance case, which means exploitation was already happening in a live environment before anyone outside Cisco had a reason to look for it. For a product that sits at the center of enterprise network control, that is a narrow margin between a customer noticing something wrong and an advisory going out.

Reading It on VulnTracker

The CVE-2026-76504 page on VulnTracker shows the 9.8 critical score with the full CVSS vector broken out by component, so you can see at a glance that the attack needs no privileges and no user interaction. The CISA KEV banner marks it actively exploited, with the September 30 add date and the remediation countdown tracked against it. EPSS score and percentile sit alongside the CVSS breakdown, giving a second read on real-world exploitation likelihood. The page tags CWE-177 and lists SSVC markers for exploitation status and impact. Track the CVE from the page to get notified if Cisco revises the advisory or NVD updates the record.

What to Do Now

Upgrade to the fixed release for your branch now: 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, or 26.2.1. Cloud-hosted customers should confirm they are on Release 20.15.605 or later rather than assume the automatic fix applied. There is no workaround, so until you patch, restrict network and management-plane access to SD-WAN Manager to trusted sources only. Check authentication logs for URL-encoded variations of the j_security_check path and for any account beginning with viptela-reserved-, which is the signature Cisco has tied to a successful bypass. If you find either, treat the system as compromised: run request admin-tech to capture forensic data and open a Severity 3 case with Cisco's Technical Assistance Center. Under BOD 26-04, internet-exposed assets with admin-level impact and a KEV listing carry a three-day remediation window for federal agencies, and that timeline is a reasonable floor for anyone running SD-WAN Manager at the edge.

CVE-2026-76504 is a reminder that a vendor's own support queue is sometimes the first place exploitation shows up, well before a CVE number exists. If Catalyst SD-WAN Manager sits anywhere in your network, patch it this week and check your logs for the viptela-reserved- pattern regardless of what version you are running. Track CVE-2026-76504 on VulnTracker to follow the advisory as Cisco updates it.

References

Cisco Security Advisory cisco-sa-sdwan-webauth-xr8beuuU · NVD/CVE.org entry for CVE-2026-76504 · CISA KEV and remediation timeline · field reporting on exploitation