Patch now: Attackers bypass login on Cisco Catalyst SD-WAN Manager

A vulnerability in the login logic of Cisco Catalyst SD-WAN Manager allows attackers to remotely access vulnerable systems with administrative privileges. With these rights, they can remotely control the devices via the integrated API.

The vulnerability, identified by CVE ID CVE-2026-76504, has a CVSS score of 9.8/10 and is therefore classified as critical. It is based on incorrect URL encoding of a request like “ j_security_check ” to “ %6a_security_check ”, meaning it is a bug in the input validation of URL processing.

In its security advisory , Cisco mentions two possible detection methods: the log files “ /var/log/nms/serviceproxy-access.log ” and “ /var/log/nms/vmanage-server.log ”. Anyone finding the string “/%6a_security_check” there should look closer, although it can also occur during normal usage.

Since Cisco maintains half a dozen versions of SD-WAN Manager, there are as many patch versions:

Customers can obtain updates in the download area as usual. Customers should not delay updating their instances. Cisco’s PSIRT (Product Security Incident Response Team) has been aware of active attacks since an unspecified date in September 2026. Anyone suspecting their device has already been compromised should submit a support request to TAC (Technical Assistance Center).

Cisco Catalyst SD-WAN Manager has had a catastrophic security record in recent months: in April , May , June , August , and now in September, there have been critical vulnerabilities that have been exploited by attackers. A total of eight of these vulnerabilities have made it onto the US cybersecurity agency CISA’s list of “known exploited vulnerabilities” this year.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.