Fixing and finding

[Jump to remediation plan](#remediation)

CVE ID

# CVE-2026-76504

Published 2026-09-30

Updated 21 days ago

Vendor/s

Cisco

Product/s

Catalyst SD-WAN Manager

Version/s

\* > 20.9.10.1

KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild.

CVSS Score (v3.1)

9.8

/ 10

Critical

Severity Details

Base score

9.8 Critical

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Table of Contents

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

## Description

CVE-2026-76504 is a critical 9.8 auth bypass in Cisco Catalyst SD-WAN Manager. Actively exploited; unauthenticated attackers can gain admin access.

## Why this matters

"CVE-2026-76504 is a critical vulnerability with a CVSS score of 9.8 and is currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. It allows unauthenticated, remote attackers to gain full administrative access to Cisco Catalyst SD-WAN Manager by exploiting improper URI encoding handling. Because this product manages wide-area network infrastructure, a successful exploit grants attackers total control over network traffic, configuration, and sensitive data across the entire SD-WAN fabric. Security teams must prioritize this update immediately, as active exploitation indicates that threat actors are already leveraging this bypass to compromise enterprise environments."

## CPE

Cisco

| Product                   | Version Start | Version End (excl.) | Status     |
| ------------------------- | ------------- | ------------------- | ---------- |
| catalyst\_sd-wan\_manager | \*            | 20.9.10.1           | vulnerable |
| catalyst\_sd-wan\_manager | 20.12         | 20.12.8.2           | vulnerable |
| catalyst\_sd-wan\_manager | 20.15         | 20.15.6.1           | vulnerable |
| catalyst\_sd-wan\_manager | 20.18         | 20.18.4.1           | vulnerable |
| catalyst\_sd-wan\_manager | 26.1          | 26.1.2.1            | vulnerable |
| catalyst\_sd-wan\_manager | 26.2          | 26.2                | vulnerable |

## Related weakness (CWE)

CWE-177

## Remediation plan

1

### Apply official patches

Consult the Cisco Security Advisory (cisco-sa-sdwan-webauth-xr8beuuU) to identify and download the appropriate software update for your specific deployment of Catalyst SD-WAN Manager.

2

### Update affected systems

Upgrade to fixed versions: 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, or later releases. Systems on version 26.2 and earlier must be updated to a patched branch.

3

### Restrict access

Implement strict Access Control Lists (ACLs) to limit access to the SD-WAN Manager API and web interface, ensuring only authorized management networks and trusted IP addresses can reach the component.

4

### Monitor for exploitation

Audit system logs for unusual URI patterns in HTTP requests and review administrative login history for unauthorized sessions originating from external or unknown sources.

## Detection Guidance

"Monitor web server and API logs for HTTP requests containing unusual URI encoding or character sequences designed to bypass authentication filters. Specifically, look for successful authentication events to the 'admin' account that do not correlate with known administrative activity. Organizations should also use Network Intrusion Detection Systems (NIDS) to flag suspicious traffic targeting the Catalyst SD-WAN Manager API endpoints."

## References

[https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU Mitigation Vendor Advisory ](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-76504 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76504)

## Sources

NIST National Vulnerability Database (NVD)

CISA Known Exploited Vulnerabilities (KEV)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](https://www.upguard.com/contact-sales)

[Free trial](https://www.upguard.com/demo)