The short answer
CVE-2026-76504 lets an attacker with no credentials use the Cisco Catalyst SD-WAN Manager API as the admin user, and it is being exploited now. Cisco published the advisory with fixed releases on September 30, 2026. CISA listed the flaw as known exploited the same day and gave US federal agencies until October 3.
SD-WAN Manager is the console that pushes configuration and policy to every branch router in the overlay, so admin access to it is close to control of the whole network. If your company runs Catalyst SD-WAN, treat the Manager like any production system in your cloud and DevOps estate: upgrade it this week, keep it off the open internet and review its logs before you close the ticket.
What did Cisco disclose?
On September 30, 2026, Cisco published an advisory for CVE-2026-76504 in Catalyst SD-WAN Manager, the product many teams still call vManage. The bug sits in how the Manager processes URL-encoded characters in incoming HTTP requests. An attacker can encode part of an API path so that it slips past an authentication rule for a specific endpoint, then use the API with the rights of the admin user. Cisco rates it 9.8 out of 10.
Cisco says the vulnerability affects devices regardless of configuration, that there is no workaround and that exploitation is already happening. The company found it while working on a TAC support case. According to Rapid7 and BleepingComputer, attackers write the letter “j” as %6a, so malicious requests target /%6a_security_check instead of the normal login handler. CISA added the CVE to its Known Exploited Vulnerabilities catalog the same day and told federal civilian agencies to fix it by Saturday, October 3.
Why is a Manager bypass worse than a router bug?
A flaw in one branch router exposes one site. SD-WAN Manager is the management plane for the whole fabric: it holds device templates, routing and security policy, certificates and the admin accounts that change them. Admin rights on its API are the keys to every edge device it manages. An attacker can read the topology, change policy or create accounts that survive a later patch.
The timeline matters too. This is the fifth Cisco SD-WAN flaw exploited in the wild this year, after CVE-2026-20127 in February, CVE-2026-20182 in May and CVE-2026-20245 and CVE-2026-20262 in June. Teams that patched in the spring and moved on are not protected: every one of those fixes predates this bug. The fixed build now has to be checked against the September 30 advisory, not the last one you acted on.
What it means for US & EU software teams
First, network management consoles are now a regular zero-day target. Five exploited SD-WAN flaws in nine months is a cadence, not bad luck. Application teams ship through reviews, CI and staged rollouts, while the controller that routes traffic between offices, clouds and data centers is often patched by hand when someone notices an advisory. That gap is what attackers use. Controller upgrades need an owner, a tested runbook and a rollback plan so they can go out within a day.
Second, keeping the management plane off the internet is the cheapest control you have. Rapid7 and Cisco both point out that internet-exposed Managers carry the most risk. A Manager reachable only from a management VPN or an allowlist of jump hosts would still need the patch, but it would not be open to anyone who scans for it.
Third, “we patched” is not the same as “we were not breached”. Admin API access means configuration and accounts may have changed before the upgrade. For EU organizations that brings GDPR breach assessment, NIS2 incident reporting and, for financial entities, DORA ICT-incident rules into play. US companies with SOC 2 or PCI DSS scope will be asked the same question by auditors and customers: can you show you checked?
What should you do now?
- Find every Manager. List all SD-WAN Manager instances, including lab, DR and cluster nodes, with their exact release. Anything below 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 or 26.2.1 on its train is vulnerable.
- Save the logs, then upgrade. Copy
serviceproxy-access.logandvmanage-server.logbefore patching, then upgrade as an emergency change. Releases older than 20.9 have to move to a fixed train. - Cut exposure until you patch. Follow Cisco’s guidance and allow Manager access only from known, trusted hosts behind a firewall. This is a stopgap, not a fix.
- Hunt for indicators. Search the logs for
j_security_checkrequests with encoded characters such as%6afrom unknown IPs, and for any username starting withviptela-reserved-. Compare device templates and policies against a known-good backup. - Rotate and re-test. If you find anything, rotate admin and API credentials, review accounts and certificates, and put the management plane into your next penetration test.
Frequently asked questions
What is CVE-2026-76504?
CVE-2026-76504 is a critical authentication bypass in Cisco Catalyst SD-WAN Manager, the central management plane formerly known as vManage. It is rated CVSS 9.8 and caused by improper handling of URL-encoded characters in HTTP requests (CWE-177). An unauthenticated remote attacker can send a crafted request that skips an authentication rule on an API endpoint and use the Manager API with the privileges of the admin user. Cisco published the advisory on September 30, 2026.
Is CVE-2026-76504 being exploited?
Yes. Cisco says its PSIRT became aware of exploitation in September 2026; the issue was found while handling a Cisco TAC support case. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 30, 2026 and ordered US federal civilian agencies to remediate by October 3, 2026. BleepingComputer counts it as the fifth Cisco SD-WAN zero-day exploited in 2026.
Which SD-WAN Manager versions fix CVE-2026-76504?
Fixed releases are 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1. Releases older than 20.9 must migrate to a fixed release. According to Rapid7, Cisco-managed cloud instances were patched in release 20.15.605. The flaw affects devices regardless of configuration and Cisco offers no workaround.
How can we check whether our SD-WAN Manager was compromised?
Review /var/log/nms/containers/service-proxy/serviceproxy-access.log and /var/log/nms/vmanage-server.log for requests to j_security_check with URL-encoded characters, such as POST /%6a_security_check, from unknown IP addresses, and for activity by usernames starting with viptela-reserved-. Preserve those logs before upgrading. A clean log review lowers the risk but does not prove the system was never accessed.
What should we do if we cannot patch immediately?
Cisco advises restricting access to SD-WAN Manager from unsecured networks and allowing only known, trusted hosts behind a firewall. This reduces exposure but does not fix the flaw, so treat it as a stopgap measured in hours, not weeks, and schedule the upgrade as an emergency change.
Sources
Cisco — Security Advisory: Catalyst SD-WAN Manager authentication bypass (CVE-2026-76504)
CISA — CISA Adds One Known Exploited Vulnerability to Catalog (Sept 30, 2026)
BleepingComputer — Cisco warns of new SD-WAN zero-day exploited in attacks
Rapid7 — Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)
The Hacker News — Cisco warns of attackers exploiting critical authentication bypass in SD-WAN Manager