Unauthenticated authentication bypass caused by improper handling of URL encoding (CWE-177) in the API session management layer.
A crafted request reaches a privileged endpoint and is treated as an authenticated admin session.
The vulnerability allows a remote unauthenticated attacker to bypass intended access controls on the Catalyst SD-WAN Manager API. Once the bypass succeeds, the attacker operates with full administrative privileges and can read configuration, modify system state, or issue management commands.
Vulnerable releases of Cisco Catalyst SD-WAN Manager prior to the vendor patch for CVE-2026-76504 (primarily 20.x and late 17.x trains still in production use).
URI decoding is performed inconsistently. Certain hex-encoded sequences are accepted by the request router but are not normalized before the authentication decision. As a result, the session validation logic is skipped for the targeted API path.
python3 exploit.py --target --cmd "show running-config"
python3 exploit.py --target --check
python3 exploit.py --target --cmd "request nms all"
us for private access: [email protected]
- Establishes admin-level API context without credentials
- Executes the supplied management command under the elevated session
Useful for controlled validation of the vulnerability, detection engineering, and confirming that the applied patch actually blocks the encoding path.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
