Vulnerability · CVE-2026-76504
Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
Published Sep 30, 2026 · corrected/updated Oct 2, 2026 · Cisco Catalyst SD-WAN Manager · evidence confidence very high
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.
Grounded briefings
Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.
Executive
CVE-2026-76504 is a critical public vulnerability record for Cisco Catalyst SD-WAN Manager. CISA lists it as known exploited. Published remediation guidance: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.
System administrator
Identify whether Cisco Catalyst SD-WAN Manager is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: cisco/catalyst sd-wan manager; cisco/catalyst sd-wan manager (26.2); Cisco Catalyst SD-WAN Manager. Published remediation guidance: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.
Security analyst
Signals on file: CVSS 9.8, EPSS 1.8%. CISA lists it as known exploited. Weakness classes: CWE-177. Sources contributing to this record: cisa_kev, cisco, cve_org, epss. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.
Exploitation and remediation
Exploitation evidence
Confirmed in CISA KEV since Sep 30, 2026. Listed in CISA KEV and VulnCheck KEV.
Patch and remediation
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA due date Oct 3, 2026.
Safe detection guidance
Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.
Technology hubs
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Sep 30, 2026 · Catalog
Detected
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specif
Sep 30, 2026 · CISA KEV
Known exploited
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating
Oct 2, 2026 · Catalog
Updated
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specif
Oct 3, 2026 · CISA KEV
Remediation due
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating
Affected
- cpe cisco/catalyst sd-wan managerversion unspecified
- cpe cisco/catalyst sd-wan manager26.2
- vendor Cisco Catalyst SD-WAN Managerversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2026-76504
Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.
cisa.gov - Cisco Security AdvisoriesVendor advisoryCVE-2026-76504
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an
sec.cloudapps.cisco.com - CVE.orgVulnerability recordCVE-2026-76504
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-76504
30-day exploitation probability 1.8%
first.org - NIST NVDVulnerability recordCVE-2026-76504
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in
nvd.nist.gov - Rapid7 Vulnerability DatabaseResearchCVE-2026-76504
Overview On September 30, 2026, Cisco published a security advisory for CVE-2026-76504 , a critical API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager. The vulnerability has a CVSSv3.1 score of 9.8 and results from improper handling of URL encoding ( CWE-177 ). An unauthenticated, remote attacker can send a crafted HTTP request that bypasses an authentication rule for
rapid7.com - VulnCheck KEVConfirmed exploitationCVE-2026-76504
Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.
vulncheck.com