Skip to content
Critical Authentication Bypass in Cisco Catalyst SD-WAN Manager Exploited

Critical Authentication Bypass in Cisco Catalyst SD-WAN Manager Exploited

First seen 30 Sep 2026, 17:30 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 1, 2026 at 17:05 UTC
  • •CVE-2026-76504 allows unauthenticated admin access to Cisco Catalyst SD-WAN Manager.
  • •Active exploitation of this vulnerability has been confirmed since its disclosure.
  • •Organizations are urged to patch affected systems immediately to prevent unauthorized access.

On September 30, 2026, Cisco disclosed a critical vulnerability (CVE-2026-76504) in the Catalyst SD-WAN Manager that allows unauthenticated remote attackers to bypass authentication and gain admin-level access to the system. This flaw stems from improper handling of URI encoding in HTTP requests, enabling attackers to send crafted requests that skip authentication checks. The vulnerability affects all versions of Cisco Catalyst SD-WAN Manager prior to the patched releases. Cisco confirmed that the vulnerability has been actively exploited in the wild, prompting urgent patching recommendations. Organizations with internet-exposed instances of the SD-WAN Manager are particularly at risk. Cisco has provided indicators of compromise (IOCs) to help organizations detect potential exploitation. The CVSS score for this vulnerability is 9.8, classifying it as critical. Immediate action is required to mitigate risks associated with this vulnerability.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 41d ago How this analysis works

Timeline

2026-09-30
CVE-2026-76504 disclosed
Cisco announced a critical authentication bypass vulnerability in Catalyst SD-WAN Manager, affecting all versions prior to the patch.
Bleepingcomputer
2026-09-30
Active exploitation confirmed
Cisco confirmed that CVE-2026-76504 is being actively exploited in the wild, necessitating urgent patching.
Watchtowr
2026-09-30
CISA adds CVE to KEV catalog
CVE-2026-76504 was added to CISA's Known Exploited Vulnerabilities catalog on the same day it was disclosed.
Digital.Nhs.Uk

More articles in this cluster (43)

Following this threat?

Track Cisco and CVE-2026-20127 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (18)

1 / 4

Common questions

Which versions are affected?
All versions of Cisco Catalyst SD-WAN Manager prior to the patched releases are affected.
Is this being exploited?
Yes, active exploitation of CVE-2026-76504 has been confirmed.
What should we do first?
Organizations should urgently apply the latest patches provided by Cisco to mitigate the vulnerability.