Successful exploitation of CVE-2026-76504 could allow a remote attacker to bypass authentication by sending a crafted HTTP request to the API of the affected system
Successful exploitation of CVE-2026-76504 could allow a remote attacker to bypass authentication by sending a crafted HTTP request to the API of the affected system
The following platforms are known to be affected:
20.9 prior to 20.9.10.1
20.12 prior to 20.12.8.2
20.15 prior to 20.15.6.1
20.18 prior to 20.18.4.1
26.1 prior to 26.1.2.1
NOTE: Deployments prior to 20.9 are end-of-support, organisations should migrate to a supported version.
Exploitation of CVE-2026-76504
Cisco has stated vulnerability CVE-2026-76504 has been exploited in the wild. The NHS England National CSOC assesses further exploitation as highly likely.
Edge devices like Cisco Catalyst SD-WAN are often internet-facing by design and are highly attractive targets to attackers, and there are an increasing number of edge device vulnerabilities disclosed each year that are rapidly exploited by attackers.
The NHS England National CSOC assesses it is highly likely vulnerabilities discovered in edge devices will continue to be exploited as zero-day vulnerabilities, or shortly after vendor disclosure.
Organisations are strongly encouraged to follow NCSC-UK's vulnerability management guidance , including patching edge devices as soon as possible if a critical vulnerability is identified.
Cisco has released a security advisory to address a critical zero-day vulnerability in SD-WAN Manager. Successful exploitation could allow an unauthenticated remote attacker to bypass authentication controls and gain administrator-level privileges to the affected system.
CVE-2026-76504 - 'Improper Handling of URL Encoding' vulnerability - CVSS v3.1 Score: 9.8
Affected organisations are encouraged to review the Cisco security advisory cisco-sa-sdwan-webauth-xr8beuuU and follow the steps below.
Perform a Comprehensive Compromise Assessment
Organisations are strongly encouraged to follow the steps listed in the "Indicators of Compromise" section of Cisco's Advisory cisco-sa-sdwan-webauth-xr8beuuU
Note: Organisations are strongly encouraged to complete this step first; or collect all relevant artifacts, including a snapshot of the device and all logs, to support threat hunting after patching. Patching before conducting the compromise assessment or collecting relevant artifacts may delete critical evidence.
If evidence of compromise is detected, organisations must immediately report this to the NHS England National Cyber Security Operations Centre (CSOC) by calling 0300 303 5222 or emailing [email protected] .
Update to a Fixed Version
Organisations are strongly encouraged to update Catalyst SD-WAN Manager.
Organisations are strongly encouraged to use the Cisco Software Checker tool to determine the latest available version for their deployment.
Hardening Guidance for Cisco Catalyst SD-WAN
Organisations are encouraged to follow Cisco's hardening guidance for Catalyst SD-WAN.
Definitive source of threat updates
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.
Last edited: 30 September 2026 3:07 pm
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
