Cisco has released emergency patches for a critical authentication bypass flaw in Catalyst SD-WAN Manager after confirming that attackers were already exploiting it. The vulnerability, tracked as CVE-2026-76504, carries the maximum possible severity rating of 9.8 out of 10 and allows someone with no credentials at all to take full administrative control of an affected system.
What makes this flaw so dangerous
Catalyst SD-WAN Manager is the central console network administrators use to configure and monitor Cisco’s software-defined wide area network products. Losing control of that console does not just expose one device. It can hand an attacker the keys to how an organization’s entire network is routed and segmented.
According to Cisco’s advisory, the problem comes down to how the system handles URI encoding in incoming HTTP requests. By formatting a request in a specific way, an attacker can slip past a rule that is supposed to require authentication before reaching restricted parts of the API. Cisco said a successful attack grants access “as the admin user,” which in practice means the attacker does not need to escalate privileges afterward. They already have them.
The flaw affects Catalyst SD-WAN Manager releases 26.2, 26.1, 20.18, 20.15, 20.12, 20.9, and earlier versions before 20.9, essentially the entire current product line. Cisco has not said who discovered or reported the issue, and as of publication the company has not disclosed exactly how many organizations were compromised before the patch shipped.
Already under attack before the fix existed
Cisco said its incident response team first learned of active exploitation in September 2026 after reviewing a customer support case, meaning the vulnerability was being used in the wild before a patch was available. This is the fifth zero-day disclosed in Cisco’s SD-WAN product line in 2026 alone, a pattern that points to sustained attacker interest in the platform rather than a one-off discovery.
Cisco has published fixed software versions for every affected release: 26.2.1, 26.1.2.1, 20.18.4.1, 20.15.6.1, 20.12.8.2, and 20.9.10.1. There is no workaround for organizations that cannot patch immediately, though Cisco is advising customers to restrict internet access to SD-WAN Manager and limit connections to trusted hosts only as a stopgap. For threat hunting, Cisco pointed administrators to the serviceproxy-access.log and vmanage-server.log files, and security researchers have flagged POST requests to URL-encoded variants of “/j_security_check” as a possible sign of exploitation attempts, though Cisco notes similar log entries can also appear during normal operation.
The US Cybersecurity and Infrastructure Security Agency added CVE-2026-76504 to its Known Exploited Vulnerabilities catalog on September 30, 2026, giving federal civilian agencies until October 3 to apply the patch, an unusually tight three-day window that reflects how serious the agency considers the risk.
This is not Cisco’s first rough patch of the year. In August 2026, the company fixed nine critical vulnerabilities across its Crosswork and Secure Workload products, five of which also scored a perfect 10.0 on the CVSS scale, as we covered at the time. Organizations running Cisco networking infrastructure should treat patch management for these products as an ongoing priority rather than a one-time task.
Administrators running Catalyst SD-WAN Manager in any supported version should apply the fixed release as soon as possible and review access logs for signs of prior compromise, since the window between active exploitation and patch availability means some environments may already have been affected.
Source: SecurityWeek, with additional reporting from Help Net Security.
