Cisco Fixes Exploited Catalyst SD-WAN Manager Authentication Bypass
Tech GuruQuick Answer
Cisco confirms active exploitation of CVE-2026-76504, an authentication bypass affecting Catalyst SD-WAN Manager in all configurations. Prioritize applicable on-premises Managers for the branch-specific fixed release. Restrict untrusted management access while preserving evidence; filtering is not a fix. Cisco says its managed Cloud Hosted release 20.15.605 is fixed and requires no customer update action.
Confirm Scope And Apply The Supported Fix
What to do now: Separate on-premises Managers from Cisco-managed cloud service instances. For on-premises systems, coordinate evidence preservation, restricted management access and the supported upgrade. A successful upgrade does not establish that an already exposed Manager was never compromised.
Last verified: 2026-10-02 UTC against Cisco's advisory and CISA KEV catalog 2026.10.02. No appliance or cloud service was tested.
Scope And Authority
| Product scope | Cisco Catalyst SD-WAN Manager in all configurations |
|---|---|
| Advisory | cisco-sa-sdwan-webauth-xr8beuuU / CISA KEV CVE-2026-76504 |
| CVE | CVE-2026-76504 |
| Authoritative release date | 2026-09-30 13:00:00 UTC |
| Authority revision date | 2026-09-30 13:00:00 UTC |
| Affected versions | Cisco Catalyst SD-WAN Manager releases before the branch-specific fixed releases listed by Cisco; releases before 20.9 must migrate. |
| Fixed version | 20.9.10.1 / 20.12.8.2 / 20.15.6.1 / 20.18.4.1 / 26.1.2.1 / 26.2.1; Cloud Hosted 20.15.605 |
| CVSS base score | 9.8 (official CVSS v3.1) |
| CVSS severity | Critical |
| Exploitation status | Cisco confirms active exploitation. CISA KEV added CVE-2026-76504 on 2026-09-30. Neither statement establishes compromise of every affected Manager; assess local evidence separately. |
What Changed
The defect allows unauthenticated administrative API access through incorrectly handled URI encoding. Cisco's indicators can also occur during legitimate operation, so correlate them with authorized activity. The advisory's encoded-character example is not exhaustive; searching for that one encoding alone can miss relevant requests.
What To Validate Now
- Establish ownership and recovery. Record Manager version, hosting model and management reachability. Preserve approved recovery access before changing filters or starting maintenance.
- Review the named evidence. Cisco identifies
/var/log/nms/containers/service-proxy/serviceproxy-access.logand/var/log/nms/vmanage-server.log. Correlatej_security_checkrequests from unauthorized addresses and unexpected use ofviptela-reserved-accounts with normal administration. Preserve original logs and timestamps; do not treat one matching line as conclusive compromise. - Escalate uncertain findings. Cisco requests
request admin-techfrom the Manager before a Severity 3 TAC case withCVE-2026-76504in its title. This is a vendor-documented, unperformed collection command. Run it only with authorized administrative access and handle its archive as sensitive support evidence. - Apply the branch fix. Use the fixed-release table and Cisco's compatibility/upgrade guidance. Retain required control-component communication while restricting untrusted access. For Cisco-managed Cloud Hosted service, check remediation/version through the GUI's Help function rather than attempting an on-premises upgrade.
- Validate operation and response. Confirm the running release and test approved authentication, device management, templates and policy workflows. Keep the security investigation separate from availability checks; preserve unresolved findings and recovery decisions.
Operational Cautions
Management filtering reduces exposure but does not repair the authentication bypass. Preserve evidence before destructive cleanup, and do not generalize Cisco-managed remediation to customer-operated systems. No upgrade or log analysis was performed here; local compromise assessment and component compatibility require the deployment owner and, where appropriate, Cisco TAC.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
