Cisco Catalyst SD-WAN Manager API authentication bypass gives unauthenticated admin access (CVE-2026-76504)

What happened

CVE-2026-76504 is an authentication bypass in the API session-based authentication management of Cisco Catalyst SD-WAN Manager. Cisco describes the cause as improper handling of URI encoding in an HTTP request. A crafted request can slip past an authentication rule intended to protect a specific API endpoint. An attacker who succeeds obtains access to the management API with admin user privileges, without credentials and without any user interaction.

The CVSS v3.1 score is 9.8, with network attack vector, low complexity, no privileges, no user interaction, and high impact on confidentiality, integrity and availability.

Cisco's PSIRT wrote that it became aware of active exploitation in September 2026. CISA's KEV catalog and CISA SSVC also record the vulnerability as actively exploited.

Who is affected

The affected product is Cisco Catalyst SD-WAN Manager. The releases named in the advisory are 18.3.6, 18.3.7, 18.3.8, 17.2.10, 18.3.6.1, 18.2.0, 18.4.3 and 18.4.1.

This is a central management component for Cisco Catalyst SD-WAN deployments, so admin-level API access could let an attacker alter SD-WAN policies and configurations. Cisco rates the issue critical. Organisations that expose the management interface to the internet, or that have not yet patched, should treat this as an immediate priority.

What to do now

1. Upgrade to a fixed, patched release. Cisco states that a fix is available and strongly recommends it. No specific fixed release numbers are listed for CVE-2026-76504, so confirm the appropriate fixed version for your release train with Cisco before you schedule the update.
2. Until the update is complete, restrict access to Catalyst SD-WAN Manager. For on-premises deployments, Cisco advises blocking access from unsecured networks such as the internet, and allowing only known, trusted hosts on the ports and protocols in the user guides. Place the control components behind a filtering device such as a firewall, and filter traffic so only trusted hosts can reach the system.
3. If you use Cisco Catalyst SD-WAN Cloud Hosted, Cisco states that the mitigation is already deployed. Confirm this applies to your environment and still follow Cisco's guidance for any on-premises components.
4. Treat any unexpected admin-level API activity as suspicious while you patch.

How to detect it

Start by checking whether the management interface is reachable from the internet: a network-exposed admin API is the main route for this kind of unauthenticated bypass. In API and authentication logs, look for unusual or malformed URI-encoded requests to the affected API endpoint, and for successful admin-privilege actions coming from unexpected source addresses. If you cannot account for admin activity, investigate promptly.

Beyond the patch

Because Cisco, CISA KEV and CISA SSVC all record active exploitation, containment and detection are not just patch hygiene. Managed Detection & Response (MDR) can watch for the post-authentication activity that follows this kind of admin API takeover, and Virtual CISO Services (vCISO) can help you identify and reduce exposure on management interfaces before the next advisory lands. If you already suspect a compromise, Incident Response Retainer provides priority access to response support.