On September 30, 2026, Cisco disclosed CVE-2026-76504, a critical authentication bypass in Cisco Catalyst SD-WAN Manager with a CVSS score of 9.8. Attackers are already exploiting it in the wild, and no workaround exists. If your organization runs an on-premises SD-WAN Manager, the only real fix is to upgrade to a patched release. Here is everything we know, and exactly what to do about it.
This is the second major Cisco zero-day in September 2026. Earlier this month we covered the F5 BIG-IP zero-day (CVE-2026-94127), which followed a similar pattern: a critical network appliance flaw disclosed while attackers were already using it. The difference this time is the attack path. This one needs no credentials, no stolen session, and no user interaction. Just network access to the management API.
What happened
Cisco published security advisory cisco-sa-sdwan-webauth-xr8beuuU on September 30, 2026. The advisory describes an authentication bypass in the API session-based authentication component of Cisco Catalyst SD-WAN Manager (formerly vManage).
The root cause is improper handling of URI encoding in HTTP requests. Cisco traces it to the part of the Manager that handles login sessions: a crafted request can slip past an authentication rule that is meant to restrict access to a single API endpoint. The classic example Cisco gives is the login endpoint j_security_check. A request like POST /%6a_security_check, where %6a is just the URL-encoded letter "j", can bypass the auth check entirely. Cisco notes that %6a is only one example, and any single character encoded in the request could potentially trigger the bypass.
An attacker who pulls this off reaches the API with administrator privileges. By default the admin user holds the netadmin role, which Cisco describes as allowed to perform all operations on the device. Since SD-WAN Manager pushes configuration and policy to every edge router in the fabric, admin API access on the controller is effectively administrative reach across the whole WAN it manages. Reporting notes that a single Manager instance can manage up to 6,000 devices, so the blast radius here is large.
Exploitation status: this is a genuine zero-day
Cisco’s PSIRT became aware of active exploitation in September 2026, after the flaw surfaced during a Technical Assistance Center support case. The same day the advisory went out, Palo Alto Networks’ Unit 42 published a threat analysis confirming the vulnerability was being exploited in attacks.
Neither Cisco nor Unit 42 has said how many organizations were hit, when the attacks began, who is behind them, or what the attackers did once inside. On September 30, the US cybersecurity agency CISA added CVE-2026-76504 to its Known Exploited Vulnerabilities (KEV) catalog, giving US federal agencies three days to patch, a deadline of October 3. Cisco has released indicators of compromise to help security teams hunt for exploitation attempts.
This flaw is separate from three Cisco SD-WAN flaws fixed earlier this year: CVE-2026-20182 in May, and CVE-2026-20245 and CVE-2026-20262 in June. A comparison of the advisories shows the fixed releases for those older flaws are all older than the ones listed below, so a Manager last upgraded for the May or June patches still needs this update.
Am I affected? Patched versions
Cisco says the flaw affects all Cisco Catalyst SD-WAN Manager deployments, regardless of system configuration. No other product is listed as affected. Cisco SD-WAN Cloud (Cisco Managed) deployments are already fixed in release 20.15.605, and those customers need to take no action. Cisco Catalyst SD-WAN Cloud Hosted environments already have the network-access mitigation in place.
For customer-managed (on-premises) Managers, here are the first fixed releases per release train:
| Release train | First fixed release |
|---|---|
| Earlier than 20.9 | No direct fix; migrate to a supported fixed release |
| 20.9 | 20.9.10.1 |
| 20.12 | 20.12.8.2 |
| 20.15 | 20.15.6.1 |
| 20.18 | 20.18.4.1 |
| 26.1 | 26.1.2.1 |
| 26.2 | 26.2.1 |
Note that the table does not list the 20.10, 20.11, 20.13, 20.14 or 20.16 release trains, which Cisco’s May advisory did list. If your Manager runs on one of those trains, check with Cisco TAC on the correct upgrade path.
What to do right now
1. Inventory your Managers. Find every Catalyst SD-WAN Manager instance, note the release train, whether it is exposed to the internet, and whether it is customer-managed or Cisco-managed. If it is internet-exposed, treat this as urgent.
2. Patch. There is no workaround. Cisco is explicit: no workarounds fully address this flaw. Upgrade customer-managed Managers to the first fixed release on your train (or a later one). Trains earlier than 20.9 have no direct fix and must be migrated. Until the upgrade is done, this is mitigation, not a fix: restrict the Manager’s access from the internet, permit access only from known and trusted hosts, and place the SD-WAN control components behind filtering devices such as firewalls. Cisco’s hardening guidance says administrative interfaces like ports 443, 22 and 830 should not be exposed directly to the internet; HTTPS access to the Manager should come only from a jump host or management subnet.
3. Hunt for signs of compromise before you patch. Cisco recommends checking the service-proxy access log at /var/log/nms/containers/service-proxy/serviceproxy-access.log for requests to j_security_check from unfamiliar or unauthorized IP addresses. Also inspect /var/log/nms/vmanage-server.log for requests to encoded j_security_check paths associated with usernames beginning with viptela-reserved-. These are system service accounts, so suspicious activity on them is a red flag. Preserve these logs before upgrading, in case forensic review is needed later.
4. If you suspect compromise, engage Cisco. Collect an admin-tech file with the request admin-tech command and open a Severity 3 TAC case referencing CVE-2026-76504. Rotate administrator credentials and API tokens, and review SD-WAN control-plane configuration changes for anything you did not authorize.
For a broader security baseline while you work through this, our guide on how to protect your business from hackers covers the layered defenses, network segmentation, patch discipline, and log monitoring habits that matter most when critical flaws like this surface.
Why this one matters more than most
Network management platforms are attractive targets because they sit at the center of everything. Compromising one controller can mean pushing malicious configuration to thousands of edge devices across branches, data centers and clouds. That is exactly why authentication bypasses on management APIs get patched fast and exploited hard.
This also continues a rough stretch for Cisco’s network-management and edge products, which have drawn consistent attacker attention over the past few years. Four of the recently added Cisco flaws in the KEV catalog hit Catalyst SD-WAN Manager specifically. The lesson for infrastructure teams: keep management planes off the public internet as a default policy, not as a reaction to an advisory. The organizations scrambling least today are the ones that already followed Cisco’s hardening guidance.
We will update this post if Cisco or CISA releases more detail on the scope of exploitation.
Frequently asked questions
What is CVE-2026-76504?
CVE-2026-76504 is a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager, disclosed September 30, 2026. It lets an unauthenticated remote attacker gain administrator access to the Manager’s API by exploiting improper URI encoding handling, with a CVSS score of 9.8.
Is CVE-2026-76504 being exploited in the wild?
Yes. Cisco’s PSIRT confirmed active exploitation in September 2026, Palo Alto’s Unit 42 published a same-day threat analysis confirming attacks, and CISA added it to the Known Exploited Vulnerabilities catalog on September 30 with a patch deadline of October 3, 2026.
Which Cisco versions fix CVE-2026-76504?
The first fixed releases are 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1. Releases earlier than 20.9 have no direct fix and must be migrated to a supported patched release. Cisco-managed cloud deployments (20.15.605) are already patched.
Is there a workaround for the Cisco SD-WAN zero-day?
No. Cisco states that no workarounds fully address the flaw. The only real fix is upgrading. Until you upgrade, restrict the Manager’s access from untrusted networks, allow only known trusted hosts, and place control components behind a firewall. That reduces exposure but does not remove the vulnerability.
How do I check if my SD-WAN Manager was compromised?
Review /var/log/nms/containers/service-proxy/serviceproxy-access.log for j_security_check requests from unknown IPs, and /var/log/nms/vmanage-server.log for encoded j_security_check paths tied to viptela-reserved- accounts. If you find anything suspicious, collect an admin-tech bundle with request admin-tech and open a Severity 3 TAC case referencing CVE-2026-76504.