CVE-2026-76504
Description
CVE-2026-76504 is a critical 9.8 auth bypass in Cisco Catalyst SD-WAN Manager. Actively exploited; unauthenticated attackers can gain admin access.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| catalyst_sd-wan_manager | * | 20.9.10.1 | vulnerable |
| catalyst_sd-wan_manager | 20.12 | 20.12.8.2 | vulnerable |
| catalyst_sd-wan_manager | 20.15 | 20.15.6.1 | vulnerable |
| catalyst_sd-wan_manager | 20.18 | 20.18.4.1 | vulnerable |
| catalyst_sd-wan_manager | 26.1 | 26.1.2.1 | vulnerable |
| catalyst_sd-wan_manager | 26.2 | 26.2 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Consult the Cisco Security Advisory (cisco-sa-sdwan-webauth-xr8beuuU) to identify and download the appropriate software update for your specific deployment of Catalyst SD-WAN Manager.
Update affected systems
Upgrade to fixed versions: 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, or later releases. Systems on version 26.2 and earlier must be updated to a patched branch.
Restrict access
Implement strict Access Control Lists (ACLs) to limit access to the SD-WAN Manager API and web interface, ensuring only authorized management networks and trusted IP addresses can reach the component.
Monitor for exploitation
Audit system logs for unusual URI patterns in HTTP requests and review administrative login history for unauthorized sessions originating from external or unknown sources.
Detection Guidance
"Monitor web server and API logs for HTTP requests containing unusual URI encoding or character sequences designed to bypass authentication filters. Specifically, look for successful authentication events to the 'admin' account that do not correlate with known administrative activity. Organizations should also use Network Intrusion Detection Systems (NIDS) to flag suspicious traffic targeting the Catalyst SD-WAN Manager API endpoints."