Cisco has released patches for a Cisco SD-WAN zero-day that attackers are actively exploiting to gain administrator access. The critical vulnerability, CVE-2026-76504, affects Catalyst SD-WAN Manager and allows remote attackers to bypass authentication without existing credentials.
Cisco confirmed that its security response team learned of exploitation in September 2026. Meanwhile, CISA has added the flaw to its Known Exploited Vulnerabilities catalog.
Authentication Flaw Exposes Management Systems
Catalyst SD-WAN Manager, previously called SD-WAN vManage, lets administrators oversee up to 6,000 SD-WAN devices through one dashboard.
The vulnerability involves API session authentication and affects vulnerable deployments regardless of their configuration.
Specifically, the software mishandles URI encoding in HTTP requests. This allows a specially crafted request to bypass an authentication rule protecting an API endpoint.
As a result, an unauthenticated attacker could send a malicious request to the system’s API and obtain administrator privileges.
Cisco has confirmed ongoing attacks. However, it has not disclosed details about the attackers, their targets or the scale of exploitation.
Fixed Releases Cover Multiple Software Branches
Cisco urges customers to upgrade to a release that addresses the vulnerability. The following table lists the first fixed version for each software branch.
| Cisco Catalyst SD-WAN release | First fixed release |
|---|---|
| Earlier than 20.9 | Migrate to a fixed release |
| 20.9 | 20.9.10.1 |
| 20.12 | 20.12.8.2 |
| 20.15 | 20.15.6.1 |
| 20.18 | 20.18.4.1 |
| 26.1 | 26.1.2.1 |
| 26.2 | 26.2.1 |
Organizations running versions earlier than 20.9 therefore need to move to a fixed release.
Cisco Shares Clues for Investigating Attacks
Alongside the patches, Cisco published indicators to help security teams investigate possible compromise.
The company says attackers have used %6a, the URI-encoded form of the letter “j,” in malicious requests.
Administrators should also review entries involving j_security_check from unknown or unauthorized IP addresses in these logs:
/var/log/nms/containers/service-proxy/serviceproxy-access.log/var/log/nms/vmanage-server.log
These entries can support an investigation, although teams should assess them in context before drawing conclusions.
For further assistance, customers can contact Cisco’s Technical Assistance Center. Before opening a case, Cisco advises collecting admin-tech files to support the review.
Federal Agencies Face October 3 Deadline
CISA added CVE-2026-76504 to its Known Exploited Vulnerabilities catalog on September 30. It directed U.S. federal civilian executive branch agencies to address the flaw by October 3, 2026.
The Cisco SD-WAN zero-day follows four other actively exploited SD-WAN vulnerabilities reported earlier this year.
In February, Cisco patched CVE-2026-20127, which attackers had exploited since at least 2023. Then, in May, it confirmed attacks involving authentication bypass vulnerability CVE-2026-20182.
In June, Cisco disclosed exploitation of CVE-2026-20245 and CVE-2026-20262 to obtain root privileges. This latest disclosure adds another confirmed attack route against the company’s SD-WAN software.
0 responses to “Cisco SD-WAN Zero-Day Lets Attackers Gain Admin Access”