Cisco Catalyst SD-WAN Manager CVE-2026-76504: Another Exploited Path to Your Network Controller

Upgrade Cisco Catalyst SD-WAN Manager to a fixed release and hunt for unauthorized access, because there is no workaround and exploitation is confirmed. CVE-2026-76504 is a CVSS 9.8 authentication bypass that lets an unauthenticated remote attacker gain administrative access to the management API, and it affects all deployment types (SecurityWeek). CISA added it to the Known Exploited Vulnerabilities catalog on September 30 with a federal due date of October 3 (The Hacker News).

This is the second exploited Cisco SD-WAN bug we have written about this year, after CVE-2026-20182. The pattern is worth noticing. SD-WAN Manager, formerly vManage, is the controller that pushes configuration to every branch router. Admin access to it is close to admin access to the whole wide-area network.

What the flaw is

The vulnerability stems from improper handling of URI-encoded requests to the management interface. A crafted request bypasses authentication and reaches API endpoints with administrative privileges (CIS MS-ISAC). Cisco says all deployment types are affected and there are no workarounds (SecurityWeek).

Fixed releases

• 26.2.1
• 26.1.2.1
• 20.18.4.1
• 20.15.6.1
• 20.12.8.2
• 20.9.10.1

Release list per SecurityWeek's summary of the Cisco advisory. If you run an older train, plan a migration to a supported one; older releases will not get a fix. Cisco-hosted cloud customers should confirm with Cisco that their instance has been upgraded rather than assuming it.

What to hunt for

Cisco's guidance points to two logs on the Manager (The Hacker News):

• serviceproxy-access.log and vmanage-server.log: look for unusual requests involving j_security_check, especially from addresses outside your management network.
• Local user accounts: look for unexpected users, including names beginning with viptela-reserved-, which have been associated with exploitation.

Also review recent configuration changes and template pushes for anything you did not schedule. An attacker with controller access can change routing, add tunnels, or alter policies on edge devices, and those changes persist after the Manager is patched.

A response checklist

1. Restrict access to the Manager's web and API interfaces to a dedicated management network immediately, even before patching. It should never be reachable from the internet.
2. Upgrade to the fixed release for your train.
3. Hunt in the two logs and the local user list.
4. Audit configuration pushed to edge routers in the last 60 days.
5. Rotate credentials for Manager admin accounts and any API tokens integrated with other tools.
6. If you find evidence, treat it as an incident: preserve logs, open a Cisco TAC case, and review the edge devices individually.

The bigger lesson: management planes

Network controllers, firewall managers, and remote-access gateways have dominated KEV additions this year. We saw it with Cisco Secure Firewall Management Center and with Check Point, Arista, and F5 in September. They are attractive because one compromise yields control of many devices. The defensive answer is the same each time: put management interfaces on an isolated network, send their logs to a monitored SIEM, and patch them on a faster cycle than everything else. If your managed firewall or network team does not treat controllers as tier-zero assets, now is a good time to start.

Cyberuptive's 24/7 SOC monitors management-plane logs for exactly these patterns. Talk to us if you want help with the hunt.

Frequently asked questions

Is CVE-2026-76504 being exploited?

Yes. Cisco confirmed exploitation, and CISA added CVE-2026-76504 to its Known Exploited Vulnerabilities catalog on September 30, 2026 with a federal due date of October 3.

What does CVE-2026-76504 allow an attacker to do?

It lets an unauthenticated remote attacker bypass authentication on Cisco Catalyst SD-WAN Manager using crafted URI-encoded requests and gain administrative access to the management API.

Which Cisco Catalyst SD-WAN Manager releases fix CVE-2026-76504?

26.2.1, 26.1.2.1, 20.18.4.1, 20.15.6.1, 20.12.8.2, and 20.9.10.1.

Is there a workaround for CVE-2026-76504?

No. Cisco states there are no workarounds. Restricting management access reduces exposure while you upgrade, but upgrading is the fix.

How do I check for CVE-2026-76504 exploitation?

Review serviceproxy-access.log and vmanage-server.log for unusual j_security_check requests, check for unexpected local users such as names beginning with viptela-reserved-, and audit recent configuration pushes to edge devices.