CVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
Cisco · Cisco Catalyst SD-WAN Manager
No fix listed · Affected: Cisco Catalyst SD-WAN Manager · Exploitation: in CISA KEV since 30 Sep
ExploitationIn CISA KEV
- In CISA KEVCISA KEV catalogue30 Sep
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public2 public GitHub repositories (unverified), listed by PoC-in-GitHub23 Oct
- Not established: not seen
Higher than 98% of scored CVEs
Federal deadline
CISA KEV · added 30 Sep · catalogue entry
Passed 42 days ago
DescriptionNVD
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalogue.
- CISA KEV
- Listed since 30 Sep · catalogue entry
- Public check
- No public nuclei template
- Vendor
- Cisco
- Published
- September 2026
What changed
- PoC-in-GitHub lists 2 public GitHub repositories (unverified) PoC-in-GitHub
- CISA added it to the KEV catalogue CISA
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Coverage10 articles · 8 outlets
One row per outlet, in order of first report. First in our coverage: The Hacker News, 30 Sep.
- Wed 30 Sep, 15:38 UTC. The Hacker News, first report. Cisco Warns of Active Exploitation in Critical SD-WAN Flaw. Cites a CVE in CISA KEV.
- Wed 30 Sep, 17:32 UTC. CISA, its first report on the story. CISA Warns of Active Exploitation in Cisco SD-WAN Manager Flaw. Cites a CVE in CISA KEV.
- Wed 30 Sep, 18:38 UTC. SecurityOnline, its first report on the story. Cisco Patches Exploited SD-WAN Flaw Enabling Unauthenticated Admin Access. Cites a CVE in CISA KEV.
- Wed 30 Sep, 18:38 UTC. Rapid7, its first report on the story. Cisco SD-WAN Flaw Exploited to Grant Attackers Admin Access. Cites a CVE in CISA KEV.
- Thu 1 Oct, 08:38 UTC. SecurityWeek, its first report on the story. Cisco Patches Actively Exploited SD-WAN Manager Auth Bypass. Cites a CVE in CISA KEV.
- Thu 1 Oct, 09:51 UTC. Security Affairs, its first report on the story. CISA Flags Actively Exploited Cisco SD-WAN Authentication Flaw. Cites a CVE in CISA KEV.
- Thu 1 Oct, 11:31 UTC. The Hacker News. Cisco SD-WAN Flaw Exploited to Bypass Authentication as Admin. Cites a CVE in CISA KEV.
- Thu 1 Oct, 13:01 UTC. SOCRadar, its first report on the story. Actively Exploited Cisco SD-WAN Flaw Grants Unauthenticated Admin Access. Cites a CVE in CISA KEV.
- Thu 1 Oct, 14:52 UTC. Infosecurity, its first report on the story. Cisco SD-WAN Zero Day Exposes Internet Facing Systems to Attackers. Cites a CVE in CISA KEV.
- Mon 5 Oct, 04:06 UTC. SecurityOnline. Seven Newly Exploited Flaws Put Cisco, MediaWiki and Zammad at Risk. Cites a CVE in CISA KEV.
- First report
- Article
- Official notice
- Running total
Added to CISA KEV
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 30 Sep 15:38 | The Hacker News | Cisco Warns of Active Exploitation in Critical SD-WAN Flaw |
| 30 Sep 17:32 | CISA | CISA Warns of Active Exploitation in Cisco SD-WAN Manager Flaw |
| 30 Sep 18:38 | SecurityOnline | Cisco Patches Exploited SD-WAN Flaw Enabling Unauthenticated Admin Access |
| 30 Sep 18:38 | Rapid7 | Cisco SD-WAN Flaw Exploited to Grant Attackers Admin Access |
| 1 Oct 08:38 | SecurityWeek | Cisco Patches Actively Exploited SD-WAN Manager Auth Bypass |
| 1 Oct 09:51 | Security Affairs | CISA Flags Actively Exploited Cisco SD-WAN Authentication Flaw |
| 1 Oct 11:31 | The Hacker News | Cisco SD-WAN Flaw Exploited to Bypass Authentication as Admin |
| 1 Oct 13:01 | SOCRadar | Actively Exploited Cisco SD-WAN Flaw Grants Unauthenticated Admin Access |
| 1 Oct 14:52 | Infosecurity | Cisco SD-WAN Zero Day Exposes Internet Facing Systems to Attackers |
| 5 Oct 04:06 | SecurityOnline | Seven Newly Exploited Flaws Put Cisco, MediaWiki and Zammad at Risk |
- Seven Newly Exploited Flaws Put Cisco, MediaWiki and Zammad at RiskSecurityOnline · mentions it in passing
- CISA Flags Actively Exploited Cisco SD-WAN Authentication FlawSecurity Affairs
- CISA Warns of Active Exploitation in Cisco SD-WAN Manager FlawCISA · official notice
- Cisco Warns of Active Exploitation in Critical SD-WAN FlawThe Hacker News · first in our coverage
New articles also arrive in the RSS feed.