CVE-2026-76504 Cisco Catalyst SD-WAN Manager Hex Encoding
Unauthenticated remote attackers can bypass authentication via crafted HTTP requests to gain admin privileges on Cisco Catalyst SD-WAN Manager.
- Exploited in the wild
- Since 30 Sep 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-76504?
CVE-2026-76504 is a critical authentication bypass vulnerability in Cisco Catalyst Sd-Wan Manager, published on 30 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.
Weakness: CWE-177
Which versions are affected by CVE-2026-76504?
It affects 1 product.
Products include Cisco Catalyst Sd-Wan Manager.
How do I fix CVE-2026-76504?
No fix has been published for CVE-2026-76504 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 Oct 2026.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-76504 being exploited?
Yes. Attackers have exploited CVE-2026-76504 in the wild since at least 30 Sep 2026.
Public exploit code: 3 proofs of concept on GitHub.
Other vulnerabilities in Cisco Catalyst Sd-Wan Manager
- CVE-2026-20182 Cisco Catalyst SD-WAN Controller Authentication Bypass
- CVE-2026-20127 Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass
- CVE-2026-20245 Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output
- CVE-2022-20775 Cisco SD-WAN Path Traversal
- CVE-2026-20128 Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format
Sources
Also known as GHSA-xqjc-v467-8fvf.