Unauthenticated API access in Cisco Catalyst SD-WAN Manager — CVE-2026-76504 Added to KEV (Due October 3)
Cisco published CVE-2026-76504 (CVSS 3.1 9.8 per Cisco, CWE-177) in advisory cisco-sa-sdwan-webauth-xr8beuuU: improper URI-encoding handling in the API session-based authentication management of Cisco Catalyst SD-WAN Manager can let an unauthenticated remote attacker reach the API with admin privileges. CISA added it to KEV on September 30, 2026, with a federal due date of October 3. Fixed releases start at 20.9.10.1 / 20.12.8.2 / 20.15.6.1 / 20.18.4.1 / 26.1.2.1 / 26.2.1 (earlier branches migrate). No known workarounds exist; interim mitigation is restricting internet access to trusted hosts, plus the optional Live Protect shield. Cisco has confirmed exploitation in the wild.
متن المقالة مش متاح باللغة دي؛ بنعرض الإنجليزي.
On 2026-09-30 13:00 GMT, Cisco published CVE-2026-76504, an API authentication bypass in Cisco Catalyst SD-WAN Manager, in security advisory cisco-sa-sdwan-webauth-xr8beuuU. The root cause is improper handling of URI encoding in an HTTP request (CWE-177), which lets a request bypass the authentication rule that restricts a specific API endpoint. An unauthenticated remote attacker can exploit it to access the API with the privileges of the admin user. Cisco rates it CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, Critical). Cisco says the vulnerability affects Cisco Catalyst SD-WAN Manager regardless of system configuration; releases earlier than 20.9 must migrate to a fixed release, and 20.9 and later must upgrade to 20.9.10.1 / 20.12.8.2 / 20.15.6.1 / 20.18.4.1 / 26.1.2.1 / 26.2.1 or later (Cisco Managed, Cisco SD-WAN Cloud Release 20.15.605, has the fix and needs no user action). Cisco states there are no workarounds that address the vulnerability; the on-prem interim mitigation is to restrict internet access to known trusted hosts on the documented ports and protocols. Cisco also offers a Live Protect shield as temporary, partial protection, with the caveats that a legitimate user logging in with URI-encoded input may be unable to sign in while it is applied, and that upgrading to a fixed release is the only complete remediation. Cisco has confirmed active exploitation (advisory version 1.1, updated 2026-10-02) and publishes example IOCs: requests to %6a_security_check (URI-encoded j_security_check) in /var/log/nms/containers/service-proxy/serviceproxy-access.log, and the same requests recorded for user names starting with viptela-reserved- in /var/log/nms/vmanage-server.log. Cisco asks customers to open TAC cases at Severity 3 with the CVE-ID in the title (cisco-sa-sdwan-webauth-xr8beuuU).
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 30, 2026, with a federal due date of October 3 (BOD 26-04, three days after listing). The KEV notes require applying vendor-directed mitigations in line with BOD 26-04 and the CISA Forensics Triage Requirements; forensicTriage is Yes and known ransomware campaign use is Unknown. The KEV short description calls it a hex-encoding vulnerability that can let an unauthenticated remote attacker access the system with admin privileges (CISA KEV catalog 2026.10.04, 1,734 entries). That week also saw FortiMail (CVE-2026-104286, listed October 1) and two Zammad entries (CVE-2026-102490 / CVE-2026-102489, listed October 2), keeping the concentration on edge devices and management interfaces (CISA KEV catalog, 2026.10.04).
Analysis (kept separate from the reporting): the point worth noting here is that a single-character URI encoding defeats the authentication rule, and that the API it gates carries admin privileges. The %6a_security_check example shows that any one-character encoding of j_security_check passes through the same handling that legitimate login traffic uses, which is why a naive string-match block in a WAF can produce false positives — consistent with the same caveat Cisco attaches to the Live Protect shield. Because Cisco positions the fix as "upgrade only, no workarounds," organizations whose SD-WAN control component requires a maintenance window now have to fit that window inside the October 3 deadline. Cisco Catalyst SD-WAN Manager has appeared on the KEV catalog before (CVE-2026-20122 / CVE-2026-20133 / CVE-2026-20128 in April, CVE-2026-20262 and CVE-2026-20245 in June); this post does not count which KEV entry number this is for the product, because the catalog carries variant product-name spellings.
Implications for defenders: (1) Plan now to upgrade to 20.9.10.1 / 20.12.8.2 / 20.15.6.1 / 20.18.4.1 / 26.1.2.1 / 26.2.1 or later (or migrate earlier branches to a fixed release), and verify Cisco SD-WAN Cloud is at 20.15.605 or later. (2) Until the upgrade lands, restrict internet access to the control component to known trusted hosts, ports, and protocols, fronted by a filtering device. (3) For detection, audit serviceproxy-access.log (/var/log/nms/containers/service-proxy/serviceproxy-access.log) and vmanage-server.log (/var/log/nms/vmanage-server.log) for %6a_security_check (and any other single-character-encoded j_security_check) and for user names starting with viptela-reserved-. Because the device’s own logs may have been tampered with, also work back from out-of-band sources such as WAF logs or NetFlow for traffic to the management API. (4) No workaround is known; if you apply the Live Protect shield, communicate to operations that it is partial protection and that URI-encoded legitimate logins can break while it is on. (5) Know Cisco’s TAC procedure (Severity 3, CVE-ID in the title) so the path is clear if an incident materializes. The facts come from the Cisco advisory cisco-sa-sdwan-webauth-xr8beuuU (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU), the CISA KEV catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog), and the NVD CVE record (https://nvd.nist.gov/vuln/detail/CVE-2026-76504). The analysis is described separately from the facts.