2026-10-31
Cisco Catalyst SD-WAN Manager CVE-2026-76504: admin access without a login, exploited (upgrade to a fixed release)
CVE-2026-76504 is a flaw in the API session authentication of Cisco Catalyst SD-WAN Manager (formerly vManage), the management system for Cisco's SD-WAN. Per Cisco's advisory of September 30, 2026, improper handling of URI encoding in an HTTP request lets an unauthenticated, remote attacker bypass an authentication rule and reach the API with the privileges of the admin user. It affects the product regardless of configuration and is rated CVSS 9.8. Cisco says its security team became aware of active exploitation in September 2026. There is no workaround; the fix is to upgrade to the first fixed release for your train (20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 or 26.2.1). The Cisco-managed cloud service is already fixed. CISA added it to the KEV catalog on September 30 with a due date of October 3. Our conclusion: if you run SD-WAN Manager on premises, upgrade now, keep its management interfaces off the internet, and review its logs using the checks in Cisco's advisory, because it may have been exposed for weeks.