Cisco has released security updates to address a critical zero-day in Catalyst SD-WAN Manager (tracked as). CVE-2026-76504), which attackers actively exploit to gain administrator rights.
Catalyst SD-WAN Manager, formerly known as SD-WAN vManage, is network management software that allows administrators to monitor and manage up to 6,000 SD-WAN devices from a single dashboard.
“In September 2026, the Cisco PSIRT became aware of the active exploitation of this vulnerability.” the company warned on Wednesday. “Cisco strongly recommends that customers upgrade to a fixed software release to address this vulnerability.”
The CVE-2026-76504 vulnerability affects all deployments regardless of system configuration, was found in API session-based authentication management, and allows unauthenticated attackers to remotely access vulnerable systems with administrative privileges.
“This vulnerability is due to improper handling of URI encoding in an HTTP request, allowing the request to bypass an authentication rule intended to restrict access to a specific API endpoint,” Cisco added.
“An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system.”
While the company did not share further details about attacks exploiting CVE-2026-76504, it did share Indicators of Compromise (IOCs) that alert administrators that threat actors are using %6a as the URI-encoded “j” character in malicious requests.
It also recommended that security teams investigating potentially compromised SD-WAN systems check this serviceproxy-access.log File is below /var/log/nms/containers/service-proxy and the vmanage-server.log File under /var/log/nms/for entries related to j_security_check from unknown or unauthorized IP addresses.
“For help determining whether a Cisco Catalyst SD-WAN Manager has been compromised, customers can open a case with Cisco TAC,” it added, initially advising administrators to do so Collect admin tech files to support the review.
| Cisco Catalyst SD-WAN version | First permanent publication |
|---|---|
| Before September 20th | Migrate to a fixed version. |
| 20.9 | 20.9.10.1 |
| 12/20 | 20.12.8.2 |
| 20.15 | 20.15.6.1 |
| 20.18 | 20.18.4.1 |
| 26.1 | 26.1.2.1 |
| 26.2 | 26.2.1 |
Fifth actively used SD-WAN zero-day in 2026
CVE-2026-76504 is the fifth SD-WAN zero-day vulnerability to be actively exploited since the beginning of the year.
Cisco in February patched an information disclosure vulnerability in SD-WAN Manager (CVE-2026-20127) that has been exploited since at least 2023, and flagged a maximum-severity Catalyst SD-WAN Controller authentication bypass flaw (CVE-2026-20182) as actively exploited in zero-day attacks to gain administrative privileges on unpatched devices in May.
Most recently, in early June, Cisco warned of two additional SD-WAN zero days (CVE-2026-20245 and CVE-2026-20262) that attackers were exploiting to gain root privileges on vulnerable systems.
As of November 2021, the Cybersecurity and Infrastructure Security Agency (CISA) has done this marks 90 Cisco vulnerabilities how they are being exploited in the wild, including four in the Cisco Catalyst SD-WAN Manager and seven being exploited through ransomware operations.
