---
title: "Cisco SD-WAN Manager CVE-2026-76504: Exploited Auth Bypass"
url: https://erroneo.us/security/briefs/cisco-sd-wan-manager-cve-2026-76504-api-auth-bypass/
description: "Unauthenticated admin access to Cisco Catalyst SD-WAN Manager via URI-encoded API requests, exploited and in KEV. No workaround: upgrade to a fixed release now."
type: security-brief
section: "Security Digest"
date_published: 2026-09-30
date_modified: 2026-10-02
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-76504"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Cisco SD-WAN Manager CVE-2026-76504: Exploited Auth Bypass

**Verdict: Act now.** If you run SD-WAN Manager on-prem, upgrade now and check the logs Cisco names; one crafted HTTP request gives an unauthenticated attacker admin over the controller for your whole WAN.

- **Who must act:** Every organization running Cisco Catalyst SD-WAN Manager (vManage) on-prem or in a self-managed cloud, on any configuration, below the first fixed release for its train.
- **Who can relax:** Customers on Cisco-managed SD-WAN Cloud (fixed in 20.15.605, no action needed) and organizations that don't use Catalyst SD-WAN.
- **Affected:** SD-WAN Manager releases earlier than 20.9 (no fix; migrate); 20.9 before 20.9.10.1; 20.12 before 20.12.8.2; 20.15 before 20.15.6.1; 20.18 before 20.18.4.1; 26.1 before 26.1.2.1; 26.2 before 26.2.1
- **Fixed:** 20.9.10.1; 20.12.8.2; 20.15.6.1; 20.18.4.1; 26.1.2.1; 26.2.1; SD-WAN Cloud (Cisco Managed) 20.15.605
- **CVEs:** CVE-2026-76504
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Identify every SD-WAN Manager instance and its release.
2. Upgrade to the first fixed release for your train (20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 or 26.2.1); migrate off anything older than 20.9.
3. Block access to the Manager's web and API interfaces from the internet and other untrusted networks, per Cisco's SD-WAN hardening guide.
4. If the upgrade must wait, apply Cisco's Live Protect shield for CVE-2026-76504 as temporary, partial protection.
5. Check the logs below; if anything is suspicious, collect request admin-tech output and open a Severity 3 TAC case with CVE-2026-76504 in the title.
6. After patching, review admin users, API tokens and recent policy or template changes, and rotate admin credentials.

### How to check if you are affected

- Search /var/log/nms/containers/service-proxy/serviceproxy-access.log for j_security_check requests with a URI-encoded character (for example POST /%6a_security_check) from unknown IPs.
- Search /var/log/nms/vmanage-server.log for j_security_check entries from unknown IPs, especially for usernames starting with viptela-reserved-.
- Compare any hits against baseline activity, since Cisco says some of these entries occur in normal operation, and look for unexpected configuration pushes to edge devices.

## What happened

On September 30, 2026, Cisco published a critical [advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU) for CVE-2026-76504 (CVSS 3.1 9.8, CWE-177) in Catalyst SD-WAN Manager, formerly vManage. The bug sits in the API's session-based authentication. Because the Manager mishandles URI encoding, a crafted HTTP request can slip past an authentication rule meant to protect a specific API endpoint. The attacker then has API access "with privileges of the admin user," without any credentials. Cisco found the flaw while resolving a TAC support case, and its PSIRT "became aware of active exploitation of this vulnerability in September 2026."

CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76504) the same day, with a federal deadline of October 3. Cisco updated the advisory on October 2 to announce a Live Protect shield as a stopgap. [BleepingComputer](https://bleepingcomputer.com/news/security/cisco-warns-of-new-sd-wan-authentication-bypass-zero-day-exploited-in-attacks) counts it as the fifth Catalyst SD-WAN zero-day exploited in 2026, after CVE-2026-20127, CVE-2026-20182, CVE-2026-20245 and CVE-2026-20262. [Rapid7](https://rapid7.com/blog/post/etr-critical-cisco-catalyst-sd-wan-manager-api-authentication-bypass-exploited-in-the-wild-cve-2026-76504) stresses that this is a separate API authentication path, not the vdaemon peering flaws behind the February and May incidents. Patching for those does not cover this one.

## Who is affected

Cisco says the flaw affects SD-WAN Manager "regardless of system configuration." Releases earlier than 20.9 get no fix and must migrate. The first fixed releases are:

| Train | First fixed |
|---|---|
| 20.9 | 20.9.10.1 |
| 20.12 | 20.12.8.2 |
| 20.15 | 20.15.6.1 |
| 20.18 | 20.18.4.1 |
| 26.1 | 26.1.2.1 |
| 26.2 | 26.2.1 |

Cisco-managed SD-WAN Cloud is fixed in 20.15.605 and needs no customer action. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-76504) carries CISA's "Exploitation: active, Automatable: yes, Technical Impact: total" assessment.

## Do you really need to act?

If you operate SD-WAN Manager yourself, yes, now. Admin on the Manager means control of the configuration, templates and policy pushed to every edge router it manages, which BleepingComputer notes can be up to 6,000 devices from one dashboard. Exploitation needs one unauthenticated request, it is confirmed in the wild, and Cisco lists no workaround. The Live Protect shield is described as partial protection only, and it can block legitimate logins that use URI encoding. Exposure matters too: a Manager whose web and API interfaces are reachable from the internet is the obvious target. Isolating it buys time but does not remove the bug. If your WAN is Cisco-managed cloud, or you don't run Catalyst SD-WAN, there is nothing to do.

## What to do now

1. List every on-prem or self-hosted SD-WAN Manager and its release.
2. Upgrade to the fixed release for your train. Anything earlier than 20.9 needs a migration plan now, because it will not get a fix.
3. Restrict the Manager's HTTPS and API interfaces to known admin hosts behind a filtering device, as Cisco recommends.
4. If you can't upgrade this week, deploy the Live Protect shield for CVE-2026-76504, and warn admins about the possible login side effect.
5. If the logs below show anything unexplained, run `request admin-tech` and open a Severity 3 TAC case with "CVE-2026-76504" in the title. Cisco asks for this before customers draw their own conclusions about compromise.

## How to tell if you were hit

Cisco names two places to look. First, in `/var/log/nms/containers/service-proxy/serviceproxy-access.log`, look for requests to `j_security_check` where a character is URI-encoded, for example `POST /%6a_security_check`. Cisco notes any character can be encoded. A quick pass: `grep -i '_security_check' serviceproxy-access.log | grep '%'`. Second, in `/var/log/nms/vmanage-server.log`, look for `j_security_check` entries from unknown IPs, especially for usernames starting with `viptela-reserved-`. Some of these entries appear in normal operation, so compare against your baseline. Then review admin accounts and recent template or policy pushes to edge devices.

## Timeline

- Sep 30, 2026 — Cisco publishes the advisory and fixed releases, saying its PSIRT learned of exploitation earlier in September (exact date not disclosed as of Oct 21, 2026). CISA adds CVE-2026-76504 to KEV.
- Oct 2, 2026 — Cisco updates the advisory to announce the Live Protect shield.
- Oct 3, 2026 — CISA's remediation deadline for federal agencies.

## Sources

1. [Cisco — Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability (cisco-sa-sdwan-webauth-xr8beuuU)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU)
2. [CVE record — CVE-2026-76504](https://www.cve.org/CVERecord?id=CVE-2026-76504)
3. [CISA — Known Exploited Vulnerabilities: CVE-2026-76504](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76504)
4. [Rapid7 — Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)](https://rapid7.com/blog/post/etr-critical-cisco-catalyst-sd-wan-manager-api-authentication-bypass-exploited-in-the-wild-cve-2026-76504)
5. [BleepingComputer — Cisco warns of new SD-WAN authentication bypass zero-day exploited in attacks](https://bleepingcomputer.com/news/security/cisco-warns-of-new-sd-wan-authentication-bypass-zero-day-exploited-in-attacks)

---
Source page: https://erroneo.us/security/briefs/cisco-sd-wan-manager-cve-2026-76504-api-auth-bypass/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt