Active Exploitation | Zero-Day | Authentication Bypass | KEV | CVE-2026-76504
Source Material: Cisco Advisory | Technology: Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) | Targeted Industries: Opportunistic
Executive Summary
Cisco has confirmed active exploitation of CVE-2026-76504, a critical authentication-bypass vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager. The flaw is caused by improper handling of URI encoding in an HTTP request and can allow an unauthenticated remote attacker to access the API with admin-user privileges. Cisco rates the issue CVSS 9.8 (Critical).
Organizations should assume heightened risk if SD-WAN Manager is internet-reachable or its exposure cannot be verified. Cisco states there is no workaround. It is important to first preserve relevant logs and system artifacts for compromise assessment, then upgrade to the appropriate fixed release. After remediation, validate administrator activity, configuration changes, and the health of managed SD-WAN control and edge devices.
Threat Overview and Strategic Impact
CVE-2026-76504 affects the API authentication flow of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage. Cisco describes the issue as improper handling of URI encoding that permits a crafted HTTP request to bypass an authentication rule intended to restrict access to a specific API endpoint. Successful exploitation can provide access to the API as the admin user, enabling an attacker to view or change management-plane data and potentially alter SD-WAN policy, device templates, routing, access controls, or other fabric configuration. The practical impact depends on the permissions and functions available through the compromised Manager instance, but compromise of the central management plane should be treated as a potential enterprise-wide network integrity event.
Cisco published the vulnerability on September 30, 2026 and confirmed exploitation in the wild. The vulnerability is relevant to on-premises and other deployments running affected Catalyst SD-WAN Manager releases; Cisco and NHS England Digital state that affected instances should be considered vulnerable regardless of system configuration. No threat actor or intrusion set has been publicly attributed to this activity.
CISA has added CVE-2026-76504 to the Known Exploited Vulnerabilities catalog and Cisco has directly confirmed active exploitation. Customers should assume that exposed management interfaces will be scanned and that unauthorized administrative activity may be followed by policy manipulation, credential or configuration theft, persistence, or disruption of the managed WAN.
Security Hardening and Recommendations
- Identify every Cisco Catalyst SD-WAN Manager instance, its release version, exposure path, and whether it is reachable from the public internet or untrusted networks.
- Before patching, preserve a snapshot and relevant logs for incident response.
- Upgrade urgently to the first fixed release: 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, or 26.2.1, as applicable. Releases earlier than 20.9 should be migrated to a remediated version.
- If immediate upgrade is not possible, restrict management access to trusted administrative networks, remove unnecessary internet exposure, enforce MFA and least privilege, and monitor or block suspicious requests at an upstream control. These are risk-reduction measures, not fixes.
- After upgrading, rotate potentially exposed administrative credentials and tokens, review recent administrative sessions and configuration changes, and validate the configuration of managed control and edge devices.
Detection Strategy
Prioritize logs from Cisco Catalyst SD-WAN Manager, reverse proxies, load balancers, firewalls, and identity providers. Review the serviceproxy-access.log and vmanage-server.log files for unauthenticated or anomalous requests to authentication and API paths, especially requests containing the URI-encoded string %6a or suspicious j_security_check activity. Treat requests from unfamiliar source addresses, unexpected user agents, unusual response codes, bursts of authentication attempts, and new admin sessions as high-priority leads.
Correlate SD-WAN Manager activity with audit records for administrator logins, token or session creation, API calls that modify configuration, device-template or policy changes, software or image operations, and changes to users, roles, certificates, or integrations. Compare the timing and source of changes with approved change windows. Hunt for configuration changes pushed to multiple edge devices shortly after an anomalous SD-WAN Manager session. These are triage leads, not proof of compromise, but warrant additional investigation.
Where compromise is suspected, preserve logs and system artifacts before making changes when operationally feasible, then coordinate containment, credential rotation, vendor support, and validation of downstream SD-WAN devices.
How Deepwatch Protects Our Customers
Deepwatch SOC experts are continuously monitoring for suspicious SD-WAN Manager, proxy, firewall, identity, and network telemetry; anomalous administrative sessions; and suspicious configuration changes. Customers can use this advisory to prioritize asset discovery, exposure validation, patch coordination, and compromise assessment for Cisco Catalyst SD-WAN Manager.
Relevant Detections
Please visit the Guardian Platform to access the relevant detections for this activity and ask NEXA Detection Advisor for a breakdown of which detections are enabled in your environment.
Threat Hunting Leads
- Search serviceproxy-access.log and vmanage-server.log for %6a, j_security_check, unfamiliar source IPs, unusual user agents, and unexpected authentication response codes.
- Correlate SD-WAN Manager admin sessions with audit events for policy, template, routing, access-control, credential, certificate, and integration changes.
- Identify configuration pushes to multiple edge devices that follow an anomalous Manager login or occur outside a change window.
- Check for new or modified local users, API tokens, sessions, certificates, or external integrations.
Technical Artifacts
Please visit the Guardian Platform to access the associated technical artifacts.
Threat Object Mapping
Intrusion Set:
- Unknown / not publicly attributed
Attack Pattern (MITRE ATT&CK/MITRE ATLAS):
| Tactic | Technique | Technique ID | Associated Threat Activity |
| Initial Access | Exploit Public-Facing Application | T1190 | Unauthenticated remote access to SD-WAN Manager API through crafted HTTP request. |
| Defense Evasion / Privilege Escalation | Valid Accounts: Local Accounts) | T1078.003 | URI encoding bypass grants execution context and privileges of the admin account (netadmin role). |
| Persistence | Account Manipulation | T1098 | Creation or modification of administrative users, API tokens, and credentials via compromised Manager APIs. |
| Discovery | Remote System Discovery | T1018 | Querying Manager API endpoints to enumerate connected WAN edge devices and fabric topology. |
| Execution | Command and Scripting Interpreter: Unix Shell | T1059.004 | Execution of underlying Linux CLI commands or administrative scripts on the vManage appliance. |
| Lateral Movement | Software Deployment Tools | T1072 | Pushing malicious device templates, configurations, or policy updates to downstream edge routers. |
Vulnerabilities:
- CVE-2026-76504 (CWE-177; CVSS 9.8 Critical)
Malware/Tool:
- None publicly reported or attributed
Additional Sources
CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
NHS England Digital, Critical Zero-Day Vulnerability in Cisco SD-WAN Manager: https://digital.nhs.uk/cyber-alerts/2026/cc-4861
Cisco Catalyst SD-WAN hardening guidance: https://sec.cloudapps.cisco.com/security/center/resources/Cisco-Catalyst-SD-WAN-HardeningGuide
↑
Share