Attackers reach admin on Cisco Catalyst SD-WAN Manager by encoding one URL character
Cisco says attackers are exploiting CVE-2026-76504, a 9.8-rated flaw that gives unauthenticated requests admin access to the Catalyst SD-WAN Manager API. Every configuration is affected, leaving exposed on-premises Managers needing an out-of-cycle upgrade and a check for earlier intrusion.
The Watch · Security desk
What happened
- Cisco's product security team learned of the exploitation during September, and the advisory with fixed releases followed on September 30.
- Cisco lists no workaround; its interim step is to block access from unsecured networks or limit it to known hosts behind a filtering device, then patch anyway.
- Signs of exploitation are encoded j_security_check requests in the service-proxy access log and viptela-reserved- usernames in vmanage-server.log.
- BleepingComputer counts CVE-2026-76504 as the fifth Catalyst SD-WAN zero-day exploited in the wild since the start of 2026.
Why it matters
- Who has to decide decision An internet-exposed on-premises Manager needs an out-of-cycle upgrade and a compromise review, because attackers had the bug before the fix shipped.
- Who's exposed exposure A successful request lands admin API rights on the console that manages up to 6,000 SD-WAN devices, so one Manager puts the whole fabric it runs within reach.
- What doesn't add up contradiction Hunts keyed to the %6a string in BleepingComputer's report will miss requests that encode other characters, and Cisco says any single character works.
- What it sets up precedent Separate code paths in the same internet-facing component have failed this year, so keeping the Manager off open networks also limits exposure to the next bypass.
Next story · Security · Oct 6
Atlassian tells Data Center customers to pull exposed servers offline over a 9.3 file-read flawConfirmed15 publishers
The fault is in the API's session-based authentication management [11]. "This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint," Cisco said [9]. No login is required. A crafted request from any network that can reach the Manager gets API access with the admin user's privileges [1]. The Manager, formerly vManage, is the dashboard that monitors and manages up to 6,000 SD-WAN devices [18].
Hunting needs care. BleepingComputer reported that threat actors are using %6a, the encoded letter j, in malicious requests [7]. Cisco's guidance, as Rapid7 relays it, treats %6a as one example and says encoding any single character in the request works [14]. A search for the literal string catches one variant. Cisco also says matching log entries can appear during standard operations and should be judged against normal network posture [14].
Rapid7 recommends upgrading on an emergency basis, outside normal patch cycles, and auditing affected systems for compromise because exploitation has already happened [6]. Cisco customers can open a Severity 3 TAC case with CVE-2026-76504 in the title and attach an admin-tech file produced by the request admin-tech command [12]. Rapid7 expected its own scanner checks in its October 1 content release [20].
Deployment type sets the workload. Cisco fixed its Cisco-managed SD-WAN Cloud service in release 20.15.605 and says those customers need take no action [8]. Cloud Hosted environments already sit behind the access filtering, and Cisco still says to apply updates where that filtering is in place [10]. Internet-exposed ports are what put a Manager at risk of compromise [15].
In early June, attackers used CVE-2026-20245 and CVE-2026-20262 to gain root on vulnerable SD-WAN systems [19]. Rapid7 also lists CVE-2026-20127 and CVE-2026-20182, unauthenticated peering flaws in the vdaemon service earlier this year, and notes that CVE-2026-76504 sits on a separate API authentication path [16]. In Rapid7's view, the recurrence of authentication bypasses in internet-facing Catalyst SD-WAN control components argues for emergency remediation [16]. Cisco did not share details of the attacks, so the public record does not show whether one group is behind this year's exploitation [13]. CISA has tagged 90 Cisco vulnerabilities as exploited since November 2021, four of them in Catalyst SD-WAN Manager and seven used by ransomware operations [21].
What to watch
- Whether Cisco or other responders publish who is exploiting CVE-2026-76504 and how many Managers were hit.
- Whether CISA adds CVE-2026-76504 to its catalog of exploited vulnerabilities.
- Whether new Cisco indicators reach beyond j_security_check requests or link this activity to the June CVE-2026-20245 and CVE-2026-20262 attacks.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence85
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence80
Perspective Coverage
12 publishers- Builder
- Builder 14%
- Operator
- Operator 76%
- Investor
- Investor 10%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The flaw results from improper handling of URL encoding (CWE-177); an unauthenticated, remote attacker can send a crafted HTTP request that bypasses an authentication rule for a specific API endpoint, gaining access to the API with the privileges of the admin user.
- [2]
According to Cisco, CVE-2026-76504 is being actively exploited in the wild; Cisco PSIRT became aware of the activity in September 2026.
- [3]
On September 30, 2026, Cisco published a security advisory for CVE-2026-76504, a critical API authentication bypass in Cisco Catalyst SD-WAN Manager with a CVSSv3.1 score of 9.8.
- [4]
Cisco recommends reviewing /var/log/nms/containers/service-proxy/serviceproxy-access.log for requests with an encoded character in the j_security_check path, such as POST /%6a_security_check, and /var/log/nms/vmanage-server.log for j_security_check requests associated with usernames beginning with viptela-reserved-, from unknown or unauthorized IP addresses.
- [5]
CVE-2026-76504 affects the product regardless of system configuration; Cisco has not provided a workaround, but vendor-supplied updates are available.
- [6]
Rapid7 recommends upgrading affected systems to a fixed release on an emergency basis, outside normal patch cycles, investigating internet-facing systems for signs of exploitation, and auditing affected systems for compromise because active exploitation has occurred.
- [7]
Cisco shared indicators of compromise warning that threat actors are using %6a as the URI-encoded character j in malicious requests.
- [8]
Cisco addressed the vulnerability in the cloud-based Cisco SD-WAN Cloud (Cisco Managed) release 20.15.605 and indicates no customer action is required for that service.
- [9]
"This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint,"
- [10]
There are no workarounds; as a temporary mitigation Cisco recommends on-premises customers prevent access from unsecured networks, or if internet access is required, restrict access to known trusted hosts behind a filtering device. The mitigation is already deployed in Cisco Catalyst SD-WAN Cloud Hosted environments, and organizations should apply updates even when it is in place.
- [11]
CVE-2026-76504 was found in API session-based authentication management.
- [12]
Cisco customers may open a Severity 3 TAC case with CVE-2026-76504 in the title and provide an admin-tech file generated with the request admin-tech command for help assessing a potentially compromised system.
- [13]
Cisco did not share further details regarding attacks exploiting CVE-2026-76504.
- [14]
The %6a value is only an example; according to Cisco, an attacker can exploit the vulnerability by encoding any single character in the request. The log entries can also occur during standard operations and should be evaluated against normal network posture to avoid false positives.
- [15]
Cisco Catalyst SD-WAN Manager systems with ports exposed to the internet are at risk of compromise.
- [16]
Catalyst SD-WAN Manager was affected earlier in 2026 by two critical unauthenticated peering authentication flaws, CVE-2026-20127 and Rapid7-discovered CVE-2026-20182, in the vdaemon service; CVE-2026-76504 targets a separate API authentication path, and Rapid7 says the recurrence of authentication bypasses in internet-facing Catalyst SD-WAN control components reinforces the need for emergency remediation.
- [17]
CVE-2026-76504 is the fifth SD-WAN zero-day vulnerability actively exploited in the wild since the start of 2026.
- [18]
Catalyst SD-WAN Manager, formerly SD-WAN vManage, is network management software that lets admins monitor and manage up to 6,000 SD-WAN devices from a single dashboard.
- [19]
In early June, Cisco warned of two SD-WAN zero-days, CVE-2026-20245 and CVE-2026-20262, that attackers exploited to gain root privileges on vulnerable systems.
- [20]
Rapid7 vulnerability checks for CVE-2026-76504 were expected in the October 1 content release for Exposure Command, Vulnerability Management and Nexpose.
- [21]
Since November 2021, CISA has tagged 90 Cisco vulnerabilities as exploited in the wild, including four in Cisco Catalyst SD-WAN Manager and seven abused by ransomware operations.
Sources
12 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comCisco warns of new SD-WAN zero-day exploited in attacks
1 article · September 30, 2026
- blog.rapid7.comCritical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)
1 article · September 30, 2026
- cisa.govCISA Adds One Known Exploited Vulnerability to Catalog
1 article · September 30, 2026
- Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability - Cisco
cisco.com
1 article · October 3, 2026
- csoonline.comCisco SD-WAN Manager hit by zero-day admin access attack
1 article · October 1, 2026
- helpnetsecurity.comNew Cisco SD-WAN zero-day exploited in-the-wild (CVE-2026-76504)
1 article · October 1, 2026
- horizon3.aiCVE-2026-76504 | Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability | Reversed by Horizon3
1 article · September 30, 2026
- infosecurity-magazine.comCritical Cisco Catalyst SD-WAN Zero-Day Under Active Exploitation
1 article · October 1, 2026
- scworld.comCisco Catalyst SD-WAN Manager flaw added to CISA's exploit list
1 article · October 1, 2026
- securityaffairs.comU.S. CISA adds Cisco Catalyst SD-WAN Manager flaw to its Known Exploited Vulnerabilities catalog
1 article · October 1, 2026
- securityweek.comCisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability
1 article · October 1, 2026
- thehackernews.comCisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager
3 articles · October 1, 2026
Topics and entities
Topics
- Zero-Day Vulnerabilities
- Known Exploited Vulnerabilities catalog
- Authentication Bypass Flaws
- Network management security
Entities
- WatchTowr
- Cisco Catalyst SD-WAN Manager
- Cisco
- Horizon3.ai
- CISA Known Exploited Vulnerabilities Catalog
- Rapid7
- International Data Corp.
- Jake Knott
- CISA