Cisco SD-WAN Manager CVE-2026-76504: Exploited Auth Bypass

What to do

Identify every SD-WAN Manager instance and its release.
Upgrade to the first fixed release for your train (20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 or 26.2.1); migrate off anything older than 20.9.
Block access to the Manager's web and API interfaces from the internet and other untrusted networks, per Cisco's SD-WAN hardening guide.
If the upgrade must wait, apply Cisco's Live Protect shield for CVE-2026-76504 as temporary, partial protection.
Check the logs below; if anything is suspicious, collect request admin-tech output and open a Severity 3 TAC case with CVE-2026-76504 in the title.
After patching, review admin users, API tokens and recent policy or template changes, and rotate admin credentials.

How to check if you are affected or compromised

Search /var/log/nms/containers/service-proxy/serviceproxy-access.log for j_security_check requests with a URI-encoded character (for example POST /%6a_security_check) from unknown IPs.
Search /var/log/nms/vmanage-server.log for j_security_check entries from unknown IPs, especially for usernames starting with viptela-reserved-.
Compare any hits against baseline activity, since Cisco says some of these entries occur in normal operation, and look for unexpected configuration pushes to edge devices.

What happened#

On September 30, 2026, Cisco published a critical advisory for CVE-2026-76504 (CVSS 3.1 9.8, CWE-177) in Catalyst SD-WAN Manager, formerly vManage. The bug sits in the API's session-based authentication. Because the Manager mishandles URI encoding, a crafted HTTP request can slip past an authentication rule meant to protect a specific API endpoint. The attacker then has API access "with privileges of the admin user," without any credentials. Cisco found the flaw while resolving a TAC support case, and its PSIRT "became aware of active exploitation of this vulnerability in September 2026."

CISA added the CVE to the KEV catalog the same day, with a federal deadline of October 3. Cisco updated the advisory on October 2 to announce a Live Protect shield as a stopgap. BleepingComputer counts it as the fifth Catalyst SD-WAN zero-day exploited in 2026, after CVE-2026-20127, CVE-2026-20182, CVE-2026-20245 and CVE-2026-20262. Rapid7 stresses that this is a separate API authentication path, not the vdaemon peering flaws behind the February and May incidents. Patching for those does not cover this one.

Who is affected#

Cisco says the flaw affects SD-WAN Manager "regardless of system configuration." Releases earlier than 20.9 get no fix and must migrate. The first fixed releases are:

Train	First fixed
20.9	20.9.10.1
20.12	20.12.8.2
20.15	20.15.6.1
20.18	20.18.4.1
26.1	26.1.2.1
26.2	26.2.1

Cisco-managed SD-WAN Cloud is fixed in 20.15.605 and needs no customer action. The CVE record carries CISA's "Exploitation: active, Automatable: yes, Technical Impact: total" assessment.

Do you really need to act?#

If you operate SD-WAN Manager yourself, yes, now. Admin on the Manager means control of the configuration, templates and policy pushed to every edge router it manages, which BleepingComputer notes can be up to 6,000 devices from one dashboard. Exploitation needs one unauthenticated request, it is confirmed in the wild, and Cisco lists no workaround. The Live Protect shield is described as partial protection only, and it can block legitimate logins that use URI encoding. Exposure matters too: a Manager whose web and API interfaces are reachable from the internet is the obvious target. Isolating it buys time but does not remove the bug. If your WAN is Cisco-managed cloud, or you don't run Catalyst SD-WAN, there is nothing to do.

What to do now#

List every on-prem or self-hosted SD-WAN Manager and its release.
Upgrade to the fixed release for your train. Anything earlier than 20.9 needs a migration plan now, because it will not get a fix.
Restrict the Manager's HTTPS and API interfaces to known admin hosts behind a filtering device, as Cisco recommends.
If you can't upgrade this week, deploy the Live Protect shield for CVE-2026-76504, and warn admins about the possible login side effect.
If the logs below show anything unexplained, run request admin-tech and open a Severity 3 TAC case with "CVE-2026-76504" in the title. Cisco asks for this before customers draw their own conclusions about compromise.

How to tell if you were hit#

Cisco names two places to look. First, in /var/log/nms/containers/service-proxy/serviceproxy-access.log, look for requests to j_security_check where a character is URI-encoded, for example POST /%6a_security_check. Cisco notes any character can be encoded. A quick pass: grep -i '_security_check' serviceproxy-access.log | grep '%'. Second, in /var/log/nms/vmanage-server.log, look for j_security_check entries from unknown IPs, especially for usernames starting with viptela-reserved-. Some of these entries appear in normal operation, so compare against your baseline. Then review admin accounts and recent template or policy pushes to edge devices.

Timeline#

Sep 30, 2026 — Cisco publishes the advisory and fixed releases, saying its PSIRT learned of exploitation earlier in September (exact date not disclosed as of Oct 21, 2026). CISA adds CVE-2026-76504 to KEV.
Oct 2, 2026 — Cisco updates the advisory to announce the Live Protect shield.
Oct 3, 2026 — CISA's remediation deadline for federal agencies.

Vulnerability records

CVE-2026-76504 · KEV 2026-09-30 · A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

Coverage and analysis

BleepingComputer — Cisco warns of new SD-WAN authentication bypass zero-day exploited in attacks bleepingcomputer.com