Unauthenticated admin access in Cisco Catalyst SD-WAN Manager is under active exploitation

A single URI-encoded character can carry an unauthenticated request past the authentication rule on the Catalyst SD-WAN Manager API and land it with admin privileges. That is the shape of CVE-2026-76504, and Cisco's PSIRT says it has been exploited in the wild since September 2026.

The flaw

The vulnerability sits in the API session-based authentication management of Cisco Catalyst SD-WAN Manager. Cisco classifies it as CWE-177, improper handling of URI encoding. A crafted HTTP request to the API bypasses the rule that is supposed to restrict access to a specific endpoint, and a successful exploit gives the attacker API access as the admin user. The vendor CVSS 3.1 base score is 9.8, with a network vector and no privileges required. The advisory is cisco-sa-sdwan-webauth-xr8beuuU, version 1.1 Final, last updated 2026-10-02, and tracks bug CSCww79570.

The Cisco advisory includes IOC examples showing the encoded character %6a (j) in the request, and notes that any single encoded character can be used to exploit the flaw. The advisory is the reference for the full IOC list and the log locations to audit; this article does not reproduce the raw values.

Exploitation and KEV

Cisco states that its PSIRT became aware of active exploitation in September 2026 and strongly recommends upgrading to a fixed release. CISA added CVE-2026-76504 to the Known Exploited Vulnerabilities catalog on 2026-09-30 with a federal remediation due date of 2026-10-03 and forensic triage required. The KEV entry lists knownRansomwareCampaignUse as Unknown, so there is no confirmed ransomware campaign attached to it.

The fix

There are no workarounds that address the vulnerability. For on-prem deployments, the only mitigation is to restrict internet access to the system and keep it behind filtering. Cisco SD-WAN Cloud (Cisco Managed) release 20.15.605 has already addressed the issue, with no user action required.

The fixed-release table, quoted from the live advisory page (v1.1 Final, 2026-10-02):

If you run Catalyst SD-WAN Manager

• Identify your release line and map it to the table above. Anything earlier than 20.9 needs a migration to a fixed release, not a patch.
• Upgrade to the first fixed release for your line. Cisco strongly recommends scheduling the upgrade as soon as possible.
• Audit the service-proxy and vmanage-server logs for the advisory's IOC indicators from unknown or unauthorized hosts, and open a Cisco TAC case (Severity 3, CVE-2026-76504 in the title) if you suspect compromise.
• If you cannot patch now, restrict internet exposure to the system until the upgrade ships.

Secondary: Apple CoreGraphics out-of-bounds write

The same KEV window carries CVE-2026-86950, an out-of-bounds write in CoreGraphics that can lead to arbitrary code execution when a maliciously crafted file is processed. Apple fixed it in iOS 26.7.1, iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1. Apple is aware of a report of exploitation in an extremely sophisticated targeted attack against specific individuals on iOS versions before iOS 27. CISA added it to KEV on 2026-09-29 with a due date of 2026-10-02. The 8.8 HIGH score on the NVD record is CISA-assigned, not vendor-assigned.

Sources

• Cisco Security Advisory cisco-sa-sdwan-webauth-xr8beuuU (v1.1 Final, 2026-10-02)
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-76504 added 2026-09-30; CVE-2026-86950 added 2026-09-29)
• NVD: CVE-2026-76504 and CVE-2026-86950
• Apple security content: iOS 26.7.1 and iPadOS 26.7.1
• CIS security advisory (corroborating; title confirmed)

Transparency note: This article was AI/LLM-assisted. It was drafted with language model support and reviewed by a human before publication. See How we use AI for the full workflow.