CVE-2026-76504
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.
- Published Sep 30, 2026
- CVSS 9.8 critical
- 1.6% chance of exploitation in the next 30 days (EPSS)
- In CISA's Known Exploited Vulnerabilities catalog
Affected software
In the news
- ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests The Hacker News ·
- Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes The Hacker News ·
- Cisco security advisory (AV26-978) Canadian Centre for Cyber Security ·
- CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV The Hacker News ·
- New Cisco SD-WAN zero-day exploited in-the-wild (CVE-2026-76504) Help Net Security ·
- Cisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability SecurityWeek ·
- Vulnerability in Cisco Catalyst SD-WAN CERT-FR ·
- Revenge of the SD-WAN: Exploring and Exploiting Yet Another Critical Cisco SD-WAN Vulnerability (CVE-2026-76504) VulnCheck Blog ·
- A Vulnerability in Cisco Catalyst SD-WAN Manager Could Allow for Authentication Bypass CIS MS-ISAC ·
- Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager The Hacker News ·