For: organisations that run Cisco Catalyst SD-WAN Manager (formerly vManage) on their own servers or in their own cloud account, and the partners who manage it for them. Cisco's managed cloud service is already fixed. This page is based on Cisco's security advisory, NVD and CISA's KEV catalog; it contains no attack steps or exploit code.
Developing: this page will be updated as more is published
- Who is affected
organisations that run Cisco Catalyst SD-WAN Manager (formerly vManage) on their own servers or in their own cloud account, and the partners who manage it for them. Cisco's managed cloud service is already fixed.
- Confirmed so farSee the table ↓
- Affected and fixed releases
- No login needed, admin-level API access
- Attacks in the wild
1 more
- Cisco-managed cloud
- Not yet confirmed
- How many systems were attacked or compromised
- What attackers did after gaining admin access
- Whether the name KeyDrift refers to this CVE
- What to do nowSee the steps ↓
- Find your SD-WAN Manager and its release
- Upgrade to the first fixed release for your train
- Restrict who can reach the management interfaces
2 more
- Review the logs for misuse
- After the upgrade, harden admin access
- Where to verify (source)All sources ↓
- Cisco, "Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability" (cisco-sa-sdwan-webauth-xr8beuuU, September 30, 2026; version 1.1, October 2)
- Last checked
- As of October 31, 2026 (JST)
Follow-up plans and what we checked
Cisco's advisory (version 1.1, October 2) and the KEV entry are public. We checked the advisory, NVD and CISA's KEV feed (version 2026.10.30) on October 31.
What to do today
Find your SD-WAN Manager and its release
Note the software release of every SD-WAN Manager instance, including standby and lab clusters. Cisco says all configurations are affected. If you use Cisco SD-WAN Cloud (Cisco Managed), Cisco says no action is needed; you can see the version through the Help function in the service.
Upgrade to the first fixed release for your train
20.9 to 20.9.10.1, 20.12 to 20.12.8.2, 20.15 to 20.15.6.1, 20.18 to 20.18.4.1, 26.1 to 26.1.2.1, 26.2 to 26.2.1. Releases earlier than 20.9 must migrate to a fixed release. Check Cisco's compatibility and upgrade matrices for your controllers and edge routers before you start.
Restrict who can reach the management interfaces
Cisco advises blocking access from untrusted networks such as the internet, and allowing only known, trusted hosts, behind a firewall. If you cannot upgrade today, apply this first. Cisco's temporary Live Protect shield gives only partial protection and may stop legitimate users with URI encoding from logging in.
Review the logs for misuse
Cisco's advisory lists the log files and entries to check, including logins for built-in system service accounts from addresses you do not recognise. Compare them with your normal traffic, because some entries can appear in normal use. Make an admin-tech file before you open a TAC case (Severity 3, with CVE-2026-76504 in the title).
After the upgrade, harden admin access
Cisco recommends changing the default administrator password, giving each administrator their own account with only the access they need, sending logs to an external server and keeping them long enough to investigate later. If you found signs of misuse, also review the configuration changes pushed to your edge routers in that period.
What was disclosed
- Product
- Cisco Catalyst SD-WAN Manager (formerly vManage), the central management system for Cisco Catalyst SD-WAN
- Type
- Authentication bypass caused by improper handling of URI encoding in an HTTP request (CWE-177)
- Authentication
- Not required. Result: access to the API with admin privileges (Cisco)
- Severity
- CVSS v3.1 9.8 (Cisco)
- Affected
- All configurations of releases before the fixed releases below
- Fixed
- 20.9.10.1 / 20.12.8.2 / 20.15.6.1 / 20.18.4.1 / 26.1.2.1 / 26.2.1. Cisco-managed cloud: 20.15.605 (no action needed)
- Workaround
- None. Mitigation: restrict access from untrusted networks
- Exploitation
- Cisco's security team became aware of active exploitation in September 2026
- KEV
- Added September 30, 2026; due October 3. Marked for CISA's forensic triage requirements
1. Find releases
All configurations are affected
2. Upgrade and restrict
First fixed release; trusted hosts only
3. Review logs
Checks in Cisco's advisory; TAC case if needed
Fixed releases
| SD-WAN release | First fixed release |
|---|---|
| Earlier than 20.9 | Migrate to a fixed release |
| 20.9 | 20.9.10.1 |
| 20.12 | 20.12.8.2 |
| 20.15 | 20.15.6.1 |
| 20.18 | 20.18.4.1 |
| 26.1 | 26.1.2.1 |
| 26.2 | 26.2.1 |
| Cisco SD-WAN Cloud (Cisco Managed) | 20.15.605 (applied by Cisco) |
Timeline
September 2026
Cisco's security team becomes aware of active exploitation. Cisco says the flaw was found while resolving a support case.September 30
Cisco publishes the advisory and fixed releases. CISA adds the CVE to the KEV catalog with a due date of October 3.October 2
Cisco updates the advisory (version 1.1) with the temporary Live Protect shield.October 3
The KEV due date for US federal agencies passes.October 31
No further revision of the advisory; NVD status Analyzed.
What is known and not known
| Item | What the sources say | Status |
|---|---|---|
| Affected and fixed releases | All configurations; fixed releases per train | Confirmed (Cisco) |
| No login needed, admin-level API access | Stated in the advisory | Confirmed (Cisco) |
| Attacks in the wild | Cisco aware of active exploitation in September | Exploitation confirmed (Cisco) |
| Cisco-managed cloud | Fixed in 20.15.605, no action needed | Confirmed (Cisco) |
| Number of systems attacked | Not published | Not stated |
| What attackers did after access | Not published | Not stated |
| The name KeyDrift | Not used by Cisco or CISA | Not stated |
Why this one matters for a whole network
SD-WAN Manager sets the configuration for every branch router it controls. Admin access to it is access to the network design of the whole organisation, not just one server. That is why Cisco's advice centres on keeping the management interfaces away from the internet, in addition to the upgrade.
The advisory was published together with the KEV listing, after attacks were already known. Systems that were reachable from the internet before September 30 may have been exposed before any fix existed, so an upgrade alone does not settle the question; the log review does.
Sources
Checked on October 31, 2026 (JST).
- Cisco, "Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability" (cisco-sa-sdwan-webauth-xr8beuuU, September 30, 2026; version 1.1, October 2) — sec.cloudapps.cisco.com
- Cisco, Catalyst SD-WAN Hardening Guide — sec.cloudapps.cisco.com
- NVD, CVE-2026-76504 — nvd.nist.gov
- CISA, Known Exploited Vulnerabilities Catalog (added September 30, 2026) — cisa.gov
Update history
2026-10-31: First version, based on Cisco's advisory, NVD and CISA's KEV catalog.
Read next
- Exploited the same period: Exploited edge device vulnerabilities, mid-October 2026
- Another recent Cisco flaw: Cisco ASA and FTD VPN flaw CVE-2026-76418
- Defending exposed devices: How to defend VPN devices and remote access
- Prioritising fixes: How to decide which CVEs to fix first (CVSS, EPSS, KEV)
- Terms: What is CVSS?