Cisco Catalyst SD-WAN Manager API authentication bypass grants admin access (CVE-2026-76504)

What happened

Cisco Catalyst SD-WAN Manager has a vulnerability in API session-based authentication. Improper handling of URI encoding in an HTTP request can allow an unauthenticated, remote attacker to bypass an authentication rule for a specific API endpoint. No credentials or user interaction are required; the attacker only needs network access to send a crafted HTTP request.

A successful exploit gives the attacker access to the affected system with the privileges of the admin user. Cisco rates this critical, with a CVSS 3.1 score of 9.8 and high impact on confidentiality, integrity and availability.

Exploitation is active. Cisco PSIRT has said it became aware of active exploitation in September 2026 and strongly recommends upgrading. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 30 September 2026, and CISA's SSVC assessment also marks exploitation as active.

Who is affected

Cisco lists these Cisco Catalyst SD-WAN Manager releases as affected: 17.2.10, 18.2.0, 18.3.6, 18.3.6.1, 18.3.7, 18.3.8, 18.4.1 and 18.4.3.

The vendor's advisory distinguishes between deployment types for mitigation. For on-premises deployment customer environments, Cisco advises restricting access from unsecured networks such as the internet. For Cisco Catalyst SD-WAN Cloud Hosted environments, Cisco says the mitigation is already deployed.

What to do now

1. Upgrade to a fixed Cisco Catalyst SD-WAN Manager software release. Cisco says a fixed release is available and strongly recommends that customers upgrade. The specific fixed version numbers are not listed here, so confirm the target release in Cisco's advisory before deploying.
2. Apply the vendor's mitigation for on-premises deployments. There are no workarounds that address the vulnerability, but Cisco advises restricting access from unsecured networks such as the internet. If internet access is required, restrict access to known, trusted hosts on the ports and protocols in the user guides.
3. Protect Cisco Catalyst SD-WAN Control Components behind a filtering device such as a firewall, allowing only known, trusted hosts to send traffic to the system.
4. For cloud-hosted environments, note that Cisco says this mitigation is already deployed.

How to detect it

The attack surface is the SD-WAN Manager API, and an unauthenticated request can result in admin-level API access. Look for unexpected admin-level API sessions, especially from internet-facing or untrusted addresses, and for configuration changes made through the API outside normal change windows. Cisco's advisory does not list specific indicators of compromise.

Beyond the patch

This is a pre-authentication, network-reachable vulnerability that can hand over admin-level access, and Cisco says it is being actively exploited. Patching is the immediate priority. Beyond that, the case for continuous detection and response is direct: our Managed Detection & Response (MDR) can watch for the kind of unexpected administrative API activity this flaw enables, and our Virtual CISO Services (vCISO) can help ensure management interfaces like this are not left reachable from untrusted networks.