Cisco SD-WAN Manager CVE-2026-76504: One Encoded Letter, Admin API Access

On 30 September 2026 Cisco published a critical advisory for CVE-2026-76504, an authentication bypass in the API of Catalyst SD-WAN Manager, the product formerly called vManage. Cisco says its PSIRT became aware of active exploitation in September. CISA added the CVE to the Known Exploited Vulnerabilities catalog the same day, with a federal due date of 3 October.

The bug scores 9.8 under CVSS 3.1 and needs no credentials and no user interaction. Cisco says the flaw was found while resolving a Technical Assistance Center support case.

What's affected

Cisco says every Catalyst SD-WAN Manager is affected "regardless of system configuration". The root cause is CWE-177, improper handling of URL encoding. An authentication rule meant to restrict a specific API endpoint does not match when one character in the path is percent-encoded, so the request passes through and lands with admin privileges.

Fixed releases from Cisco's advisory:

Cisco-managed SD-WAN Cloud was fixed in release 20.15.605 with no customer action required. For cloud-hosted environments, Cisco says the network mitigation is already in place.

There is no workaround. On 2 October Cisco added a "Live Protect" shield as a temporary, partial protection while you plan the upgrade. Cisco warns that with the shield applied, a legitimate user whose login uses URI encoding may be unable to sign in.

How to check if you're exposed

Check the running version from the Manager CLI with show version, or from the GUI under Administration. Anything below the first fixed release for your train is vulnerable.

Then look for exploitation. Cisco's advisory gives two log locations and an example request that encodes the letter j as %6a:

POST /%6a_security_check HTTP/1.1

Cisco is explicit that %6a is only an example. Any single encoded character in the path can trigger the bypass, so do not hunt for that literal string alone. A broader search on the service proxy log:

grep -iE 'POST /[^ ]*%[0-9a-f]{2}[^ ]*_security_check' \
  /var/log/nms/containers/service-proxy/serviceproxy-access.log*

Then check the server log for the same endpoint tied to the reserved system service accounts, which Cisco calls out by the viptela-reserved- prefix:

grep -h 'security_check' /var/log/nms/vmanage-server.log* \
  | grep 'viptela-reserved-'

Cisco notes these patterns can show up in normal operation, so weigh every hit against the source IP. A request from an address that never administers your fabric is the one to chase. Follow it forward in the logs: what API calls came next, and did any configuration templates or policies change?

If you want Cisco's help, open a Severity 3 TAC case with CVE-2026-76504 in the title and attach the output of request admin-tech from the Manager.

What to do now

1. Upgrade to the first fixed release for your train. If you run anything older than 20.9, plan a migration now, because there is no fix on those trains.
2. Until the upgrade is done, block access to the Manager from the internet. Cisco's guidance is to allow only known, trusted hosts on the ports and protocols in the user guides, behind a firewall.
3. Consider the Live Protect shield as a stopgap if you cannot upgrade this week, and test logins afterwards because of the encoding side effect.
4. Run the log searches above across every Manager node and across your full log retention. Cisco recommends sending these logs to an external server so they survive a compromise.
5. If you find a suspicious encoded security_check request, review admin accounts, configuration change history and recent policy pushes to edge routers before you trust the fabric again.

Why it matters

SD-WAN Manager is the control point for every edge router in the fabric. Admin API access there is not one compromised box. It is the ability to change routing and security policy across every site the fabric connects.

The bug class is also worth remembering. Authentication rules that match on raw path strings break as soon as the path arrives encoded differently. The same pattern appears in reverse proxies, API gateways and application filters. If your own services decide "is this route protected?" before the URL is normalized, you have the same risk.

This is not a one-off. Counting the KEV catalog's own entries, CVE-2026-76504 is the ninth Cisco SD-WAN vulnerability CISA has added in 2026, starting with two on 25 February. Treat the Manager as an internet-facing crown jewel: management access from a short allowlist, logs shipped off the box, and an upgrade path you can execute in days, not quarters.

Try it yourself

Take one internal service that enforces auth by path, for example a reverse proxy rule that protects /admin. Send a request for /%61dmin and see whether the rule still applies. If it doesn't, normalize paths before the auth check and add a test for it.

To see how newly exploited vulnerabilities in tools you run get surfaced and tracked, walk through this demo:

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Cisco Security Advisory: Catalyst SD-WAN Manager API Authentication Bypass (cisco-sa-sdwan-webauth-xr8beuuU)
• CISA: CISA Adds One Known Exploited Vulnerability to Catalog (30 September 2026)
• CISA Known Exploited Vulnerabilities Catalog
• NVD: CVE-2026-76504
• Previdian: CVE-2026-76504 Cisco Catalyst SD-WAN Manager authentication bypass exploited in the wild