Cisco Catalyst SD-WAN Manager Auth Bypass (CVE-2026-76504) Explained

Cisco has published an out-of-band security advisory for CVE-2026-76504, a critical authentication bypass in the API of the Cisco Catalyst SD-WAN Manager (the vManage line of products). The flaw carries a CVSS v3.1 base score of 9.8, affects every release regardless of configuration, and is confirmed by Cisco to be under active exploitation in the wild. It was added to the CISA Known-Exploited-Vulnerabilities (KEV) catalog on September 30, 2026, with a remediation due date of October 3, 2026.

How it works

The vulnerability is in the API’s session-based authentication management. Cisco rates it CWE-177 (improper neutralization of special elements used in a command), specifically improper handling of URI encoding in an HTTP request. A crafted request lets an attacker bypass an authentication rule that is meant to lock down a specific API endpoint, and the result is a request processed with the privileges of an admin user.

The advisory gives this as an example of the kind of request that triggers the rule (the %6a value, which URI-encodes the letter j, is Cisco’s example — any encoded single character works):

POST /%6a_security_check HTTP/1.1
Host: <target>

j_username=viptela-reserved-dca
j_password=anything

In short: a remote attacker sends a single request that walks past the authentication gate and lands a fully valid admin-level session. The attack requires no credentials, no prior privileges, and no user interaction.

Why it matters

• Unauthenticated remote access, admin-level. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, no prerequisites, with high impact to confidentiality, integrity, and availability.
• Active exploitation, no workaround. Cisco’s PSIRT confirmed the activity in September 2026. Cisco provides no workaround — the only remediation is upgrading to a fixed release.
• The manager is a crown-jewel target. A vManage device sits at the control plane for an entire SD-WAN estate. Compromising it exposes control over the WAN fabric, not just a single box.
• Exposure is real but limited. VulnCheck’s Target Intelligence currently finds roughly 1,500 internet-exposed SD-WAN vManage devices — the ones most at risk are those reachable from the public internet.

What to do

1. Check for internet exposure. Determine whether your vManage / SD-WAN Manager is reachable from the public internet. It is that population that matters most right now.
2. Upgrade to a fixed release. Cisco has published fixed software for each release train. Restrict network access to the manager until you can patch, since there is no software workaround.
3. Audit for compromise. If the system was internet-facing and unpatched, treat it as potentially compromised. Cisco points to two log files: serviceproxy-access.log (/var/log/nms/containers/service-proxy/serviceproxy-access.log) and vmanage-server.log (/var/log/nms/vmanage-server.log). Look for j_security_check entries from unknown or unauthorized source IPs, especially ones logged under usernames beginning with the reserved viptela-reserved- prefix. Cisco cautions these entries can occur during normal operations, so compare them against expected network posture before declaring a breach.

One practical detail cuts in your favor: the vManage-server.log records the session start, the authenticated user, the session ID, and the source IP. A forged admin session that a human operator did not initiate — an entry with a session ID the user never logged in with — is a concrete, grep-able indicator.

The bottom line

CVE-2026-76504 is a clean, high-value bug for attackers: one request from the internet buys admin control of a device that orchestrates an entire SD-WAN deployment, on every release, with no workaround to fall back on. The exposure is contained to the comparatively small set of managers exposed to the public internet, but that set is a deliberate and easy target. If you run Catalyst SD-WAN, this is a patch-now item, and for anyone who was internet-facing without a patch, investigate first.