Cisco has confirmed active exploitation of CVE-2026-76504, a critical vulnerability in Catalyst SD-WAN Manager that allows unauthenticated administrative access. The flaw received a CVSS score of 9.8 and was actively used in attacks during September.
The vulnerability resides in the API login session handling process. The Manager incorrectly processes URI encoding in HTTP requests, allowing an attacker to craft a request that bypasses the authentication check intended to restrict access to a single endpoint. Once the forged request reaches the API, the attacker is granted the privileges of the default netadmin role, enabling full control over all managed devices.
The attack technique mirrors the URI manipulation method observed in Oracle PeopleSoft incidents earlier the same month. No permanent workaround exists. Organizations running versions prior to 20.9 must migrate to a patched release.
Fixed versions include 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1. Until patches can be deployed, Cisco advises restricting access to the Manager from untrusted networks, including the internet, and accepting connections only from known hosts while keeping control components behind a firewall.
The flaw was identified during routine technical support and confirmed through investigation by Cisco's Product Security Incident Response Team. The CISA catalog of exploited vulnerabilities now lists eight Cisco SD-WAN flaws added in 2026.
