Cisco Fixes Exploited Catalyst SD-WAN Manager Authentication Bypass
Tech GuruQuick Answer
The authority published cisco-sa-sdwan-webauth-xr8beuuU for Cisco Catalyst SD-WAN Manager in all configurations. Cisco reports that crafted URI encoding can bypass authentication and provide remote administrative API access. Cisco confirms active exploitation and states that no workaround addresses the vulnerability. Affected deployments should be matched to the authority's exact scope and moved to the supported fixed release.
Confirm Scope And Apply The Supported Fix
What to do now: Identify every on-premises Catalyst SD-WAN Manager, remove untrusted or internet access to its management interfaces, inspect Cisco-listed logs and indicators, apply the exact branch fix, validate control-plane and administrative workflows, and retain evidence.
Last verified: 2026-10-01 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Cisco Catalyst SD-WAN Manager in all configurations |
|---|---|
| Advisory | cisco-sa-sdwan-webauth-xr8beuuU / CISA KEV CVE-2026-76504 |
| CVE | CVE-2026-76504 |
| Authoritative release date | 2026-09-30 13:00:00 UTC |
| Authority revision date | 2026-09-30 13:00:00 UTC |
| Affected versions | Cisco Catalyst SD-WAN Manager releases before the branch-specific fixed releases listed by Cisco; releases before 20.9 must migrate. |
| Fixed version | 20.9.10.1 / 20.12.8.2 / 20.15.6.1 / 20.18.4.1 / 26.1.2.1 / 26.2.1; Cloud Hosted 20.15.605 |
| CVSS base score | 9.8 (official CVSS v3.1) |
| CVSS severity | Critical |
| Exploitation status | Cisco confirms active exploitation; CISA added the CVE to KEV on 2026-09-30; no exploitation claim is inferred. |
What Changed
Cisco reports that crafted URI encoding can bypass authentication and provide remote administrative API access. Cisco confirms active exploitation and states that no workaround addresses the vulnerability.
What To Validate Now
- Inventory. Locate Cisco Catalyst SD-WAN Manager in all configurations deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: Cisco Catalyst SD-WAN Manager releases before the branch-specific fixed releases listed by Cisco; releases before 20.9 must migrate. Do not infer applicability from product family or severity alone.
- Remediate. Upgrade to Cisco's exact fixed release for the installed branch. Migrate releases before 20.9. There is no workaround; while preparing the upgrade, restrict on-premises management access to trusted hosts behind filtering. Cisco states that Cloud Hosted 20.15.605 was fixed by Cisco.
- Validate. Confirm the fixed release, review Cisco's listed log paths and indicators for unexpected administrative API activity, validate controller, template, policy, authentication, and device-management workflows, and preserve findings and change records.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Restriction of management access is a mitigation, not a fix. Evidence review and incident-response decisions should precede destructive cleanup, and cloud-hosted remediation status must not be generalized to on-premises systems.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
