Cisco Catalyst SD-WAN Manager flaw CVE-2026-76504 gives attackers admin access

What happened

Cisco has disclosed CVE-2026-76504, a critical authentication bypass (CVSS 9.8) in Cisco Catalyst SD-WAN Manager. The flaw sits in the API's session-based authentication and comes from improper handling of URI encoding in HTTP requests. A remote, unauthenticated attacker can send a crafted request, bypass an authentication rule and gain administrative access. Cisco's PSIRT became aware of active exploitation in September 2026, and CISA has added the flaw to its Known Exploited Vulnerabilities catalogue. The Cyber Security Agency of Singapore has also issued an alert.

Who is affected

All Catalyst SD-WAN Manager deployments, regardless of configuration.

What to do now

• There is no workaround. Upgrade to a fixed software release as listed in Cisco's advisory.
• Restrict access to the SD-WAN Manager interface to trusted management networks.
• Review administrator sessions, new accounts and configuration changes on SD-WAN Manager since September.

Why it matters for SOC teams

SD-WAN Manager controls how traffic moves between sites. An attacker with admin rights can change network configuration and reach connected infrastructure, often without touching a monitored endpoint. Logs from network management planes belong in your SIEM. See our analysis of this month's edge device zero-days.