Cisco on Wednesday deployed urgent patches for a critical authentication bypass in Catalyst SD-WAN Manager that has been exploited in the wild.
The flaw, tracked as CVE-2026-76504 (CVSS score 9.8), impacts the session-based API authentication mechanism and could allow remote, unauthenticated attackers to gain administrative access to a vulnerable system.
“In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to resolve this vulnerability,” the company said warned.
According to Cisco, the problem lies in the improper handling of URI encoding in an HTTP request, which allows attacker requests to reach a restricted API endpoint.
“An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected system’s API. A successful exploit could allow the attacker to bypass authentication and gain access to the API as an admin user,” explains Cisco.
All Catalyst SD-WAN Manager deployments are affected regardless of configuration and there are no workarounds.
CVE-2026-76504 is fixed in Catalyst SD-WAN versions 26.2.1, 26.1.2.1, 20.18.4.1, 20.15.6.1, 20.12.8.2, and 20.9.10.1. Cisco-managed SD-WAN deployments have also been patched.
Cisco has released Indicators of Compromise (IoCs) to help security teams identify potential attack attempts and shared general recommendations for securing vulnerable systems.
On Wednesday, the US cybersecurity agency CISA added The vulnerability was added to the Known Exploited Vulnerabilities (KEV) catalog and federal authorities were asked to fix it within three days.
Neither Cisco nor CISA have disclosed details of how the vulnerability was exploited.
“Cisco SD-WAN appears to be a ubiquitous part of CISA’s list of known exploited vulnerabilities, with eight 2026 CVEs landing on KEV this year alone – this should be an extremely clear signal that attackers have recognized the value of the platform, and this pattern is unlikely to slow down,” said Jake Knott, head of threat intelligence at WatchTowr.
“None of this should come as a surprise to anyone. As a single point of contact used by enterprises to manage, configure and monitor large networks, it is obviously an attractive target. Organizations using Catalyst SD-WAN Manager should immediately upgrade to a fixed version and follow the vendor’s instructions, including checking for POST requests to all URL-encoded variants of /j_security_check and checking instances for signs that an exploitation has already occurred,” Knott added.
Related: Google: AI is changing the pace and profile of vulnerability detection
Related: WatchGuard fixes critical code injection vulnerability in the fireware operating system
Related: Government and financial organizations targeted in weeks-long zero-day attacks on NetScaler
Related: Chrome and Firefox updates fix over 100 security vulnerabilities
