Cisco Catalyst SD‑WAN Manager API Authentication Bypass CVE‑2026‑76504 Exploited in Wild

On September 30 2026 Cisco issued a security advisory for CVE‑2026‑76504, a critical API authentication bypass that has already been leveraged in the wild.

What happened

The vulnerability stems from improper handling of URL encoding (CWE‑177) in the Catalyst SD‑WAN Manager API. An unauthenticated, remote attacker can send a crafted HTTP request that bypasses the authentication check on a specific endpoint, obtaining admin‑level access to the API.

Impact

• CVSS v3.1 score 9.8
• All versions of Catalyst SD‑WAN Manager are affected regardless of configuration.
• Systems with the management port exposed to the internet are at highest risk.
• Active exploitation has been observed by Cisco PSIRT.

What to do

Upgrade immediately to the latest firmware that contains the fix. The update is available from Cisco’s support portal; no interim workaround exists. After patching, perform a security scan of all internet‑facing Catalyst SD‑WAN Manager instances for indicators of compromise.

Note: Earlier in 2026, two other authentication bypasses (CVE‑2026‑20127 and CVE‑2026‑20182) affected the vdaemon service. This recurrence underscores the need for prompt remediation.

Additional context

Because the flaw allows full API control, attackers can modify routing policies, view sensitive data, or disrupt network operations. Defenders should also review firewall rules to restrict inbound traffic to the SD‑WAN Manager port and monitor logs for anomalous API calls.