CVE Alert: CVE-2026-76504 – Cisco – Cisco Catalyst SD

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.

**Risk verdict:** Treat this as an urgent priority 1 incident: exploitation is active and it is listed in the known-exploited catalogue.

**Why this matters:** An attacker may gain administrative control of the management plane, risking exposure or alteration of sensitive network configuration and disruption of service. That access could also support persistence or provide a route to influence managed network operations.

**Most likely attack path:** A remote attacker can target the API without credentials or user interaction, using a crafted request that exploits URI-encoding handling; the attack has low complexity. The assessed scope is unchanged, but administrative access to a platform managing network devices may enable operational effects beyond the manager itself.

**Who is most exposed:** Organisations running this management platform with API access reachable from the internet or broad corporate networks are most exposed. Check hosted and on-premises instances, including disaster-recovery and lab environments.

Review API and reverse-proxy logs for unusual encoded or double-encoded URI paths.

Identify unauthorised admin sessions, especially those without a preceding successful login.

Hunt for unexpected configuration, account, policy or software changes and unusual device-management commands.

Preserve relevant logs and investigate unexpected management-plane access.

Mitigation and prioritisation:

Treat as priority 1; urgently upgrade to a vendor-fixed release.

Restrict API and management-plane access to trusted administrative networks while preparing the change.

Review administrative activity and rotate credentials or tokens if compromise is suspected.

Confirm remediation across all instances; the provided data does not include an EPSS score or identify fixed releases, so validate those with the vendor.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.