Unauthenticated API access in Cisco Catalyst SD-WAN Manager — CVE-2026-76504 Added to KEV (Due October 3)
Cisco published CVE-2026-76504 (CVSS 3.1 9.8 per Cisco, CWE-177) in advisory cisco-sa-sdwan-webauth-xr8beuuU: improper URI-encoding handling in the API session-based authentication management of Cisco Catalyst SD-WAN Manager can let an unauthenticated remote attacker reach the API with admin privileges. CISA added it to KEV on September 30, 2026, with a federal due date of October 3. Fixed releases start at 20.9.10.1 / 20.12.8.2 / 20.15.6.1 / 20.18.4.1 / 26.1.2.1 / 26.2.1 (earlier branches migrate). No known workarounds exist; interim mitigation is restricting internet access to trusted hosts, plus the optional Live Protect shield. Cisco has confirmed exploitation in the wild.
O corpo do artigo não está disponível neste idioma; o inglês é exibido.
On 2026-09-30 13:00 GMT, Cisco published CVE-2026-76504, an API authentication bypass in Cisco Catalyst SD-WAN Manager, in security advisory cisco-sa-sdwan-webauth-xr8beuuU. The root cause is improper handling of URI encoding in an HTTP request (CWE-177), which lets a request bypass the authentication rule that restricts a specific API endpoint. An unauthenticated remote attacker can exploit it to access the API with the privileges of the admin user. Cisco rates it CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, Critical). Cisco says the vulnerability affects Cisco Catalyst SD-WAN Manager regardless of system configuration; releases earlier than 20.9 must migrate to a fixed release, and 20.9 and later must upgrade to 20.9.10.1 / 20.12.8.2 / 20.15.6.1 / 20.18.4.1 / 26.1.2.1 / 26.2.1 or later (Cisco Managed, Cisco SD-WAN Cloud Release 20.15.605, has the fix and needs no user action). Cisco states there are no workarounds that address the vulnerability; the on-prem interim mitigation is to restrict internet access to known trusted hosts on the documented ports and protocols. Cisco also offers a Live Protect shield as temporary, partial protection, with the caveats that a legitimate user logging in with URI-encoded input may be unable to sign in while it is applied, and that upgrading to a fixed release is the only complete remediation. Cisco has confirmed active exploitation (advisory version 1.1, updated 2026-10-02) and publishes example IOCs: requests to %6a_security_check (URI-encoded j_security_check) in /var/log/nms/containers/service-proxy/serviceproxy-access.log, and the same requests recorded for user names starting with viptela-reserved- in /var/log/nms/vmanage-server.log. Cisco asks customers to open TAC cases at Severity 3 with the CVE-ID in the title (cisco-sa-sdwan-webauth-xr8beuuU).
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 30, 2026, with a federal due date of October 3 (BOD 26-04, three days after listing). The KEV notes require applying vendor-directed mitigations in line with BOD 26-04 and the CISA Forensics Triage Requirements; forensicTriage is Yes and known ransomware campaign use is Unknown. The KEV short description calls it a hex-encoding vulnerability that can let an unauthenticated remote attacker access the system with admin privileges (CISA KEV catalog 2026.10.04, 1,734 entries). That week also saw FortiMail (CVE-2026-104286, listed October 1) and two Zammad entries (CVE-2026-102490 / CVE-2026-102489, listed October 2), keeping the concentration on edge devices and management interfaces (CISA KEV catalog, 2026.10.04).
Analysis (kept separate from the reporting): the point worth noting here is that a single-character URI encoding defeats the authentication rule, and that the API it gates carries admin privileges. The %6a_security_check example shows that any one-character encoding of j_security_check passes through the same handling that legitimate login traffic uses, which is why a naive string-match block in a WAF can produce false positives — consistent with the same caveat Cisco attaches to the Live Protect shield. Because Cisco positions the fix as "upgrade only, no workarounds," organizations whose SD-WAN control component requires a maintenance window now have to fit that window inside the October 3 deadline. Cisco Catalyst SD-WAN Manager has appeared on the KEV catalog before (CVE-2026-20122 / CVE-2026-20133 / CVE-2026-20128 in April, CVE-2026-20262 and CVE-2026-20245 in June); this post does not count which KEV entry number this is for the product, because the catalog carries variant product-name spellings.
Implications for defenders: (1) Plan now to upgrade to 20.9.10.1 / 20.12.8.2 / 20.15.6.1 / 20.18.4.1 / 26.1.2.1 / 26.2.1 or later (or migrate earlier branches to a fixed release), and verify Cisco SD-WAN Cloud is at 20.15.605 or later. (2) Until the upgrade lands, restrict internet access to the control component to known trusted hosts, ports, and protocols, fronted by a filtering device. (3) For detection, audit serviceproxy-access.log (/var/log/nms/containers/service-proxy/serviceproxy-access.log) and vmanage-server.log (/var/log/nms/vmanage-server.log) for %6a_security_check (and any other single-character-encoded j_security_check) and for user names starting with viptela-reserved-. Because the device’s own logs may have been tampered with, also work back from out-of-band sources such as WAF logs or NetFlow for traffic to the management API. (4) No workaround is known; if you apply the Live Protect shield, communicate to operations that it is partial protection and that URI-encoded legitimate logins can break while it is on. (5) Know Cisco’s TAC procedure (Severity 3, CVE-ID in the title) so the path is clear if an incident materializes. The facts come from the Cisco advisory cisco-sa-sdwan-webauth-xr8beuuU (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU), the CISA KEV catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog), and the NVD CVE record (https://nvd.nist.gov/vuln/detail/CVE-2026-76504). The analysis is described separately from the facts.