Cybersecurity
Cisco warns of exploited SD-WAN Manager flaw
Cisco said CVE-2026-76504 in Catalyst SD-WAN Manager was being exploited, could let an unauthenticated attacker reach the admin API, and had no workaround beyond fixed releases and access restrictions.
- Cisco said CVE-2026-76504 in Cisco Catalyst SD-WAN Manager was being exploited and could let an unauthenticated attacker reach the API as the admin user.
- Cisco said the flaw came from mishandled URI encoding in an HTTP request against the session-login part of the API.
- Cisco said its Product Security Incident Response Team learned of active exploitation in September 2026, and TAC found the issue while handling a support case.
- Cisco said there was no workaround, fixed releases existed, and internet-facing managers should be restricted to trusted hosts or placed behind a firewall.
- As of 30 September, CISA’s Known Exploited Vulnerabilities catalog listed eight Cisco SD-WAN flaws added in 2026.
Cisco said attackers were exploiting CVE-2026-76504 in Cisco Catalyst SD-WAN Manager. It said the flaw affected the part of the API used for session logins and could let an attacker use the admin interface without credentials.
The company said the bug was caused by incorrect handling of URI encoding in an HTTP request. A crafted request could bypass an access check that was meant to protect a single API endpoint.
Cisco said the default admin account carried the netadmin role and could perform all device operations. It also said the advisory did not say how many customers were affected, when the attacks began, who was behind them, or what they did after gaining access.
Cisco said fixed releases were available and that there was no workaround. It advised limiting access to on-premises managers from untrusted networks, and said Cisco SD-WAN Cloud (Cisco Managed) was already fixed while Cisco Catalyst SD-WAN Cloud Hosted already had the mitigation.
Cisco said CISA’s Known Exploited Vulnerabilities catalog listed eight Cisco SD-WAN flaws added in 2026 as of 30 September. It said the new issue was separate from earlier Cisco SD-WAN flaws fixed in May and June.
Named in this story
Companies
- Cisco
- issued the advisory and said it had seen active exploitation
Organisations
- Cisco Product Security Incident Response Team
- identified active exploitation in September 2026
- Cisco Technical Assistance Center (TAC)
- handled the support case that found the flaw
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency
- kept the Known Exploited Vulnerabilities catalog that listed Cisco SD-WAN flaws
Products and systems
- Cisco Catalyst SD-WAN Manager
- the affected management system
- Cisco SD-WAN Cloud (Cisco Managed)
- was already fixed in release 20.15.605
- Cisco Catalyst SD-WAN Cloud Hosted
- already had the mitigation in place
How the source tells it
The piece kept a technical advisory register, with urgency coming from Cisco's warnings about active exploitation and exposure.
- urgency active exploitation and immediate upgrade advice drive the framing