In-the-Wild Exploitation Targets Cisco Catalyst SD-WAN via Critical URL-Encoding Auth Bypass
Cisco has released emergency updates to patch a critical authentication bypass flaw affecting Catalyst SD-WAN Manager, tracked as CVE-2026-76504 with a maximum CVSS v3.1 score of 9.8. The vulnerability is classified under CWE-177 and stems from improper handling of URI-encoded characters during session-based API authentication processing. By issuing a crafted HTTP request with encoded paths—such as swapping a standard character for `%6a` targeting the `j_security_check` endpoint—an unauthenticated remote attacker can bypass authentication controls. Successful exploitation grants the attacker full administrative access to the underlying management API without requiring valid credentials or user interaction. Cisco discovered the issue in September 2026 after active exploitation was identified during a Technical Assistance Center support engagement. All Catalyst SD-WAN Manager deployments are affected regardless of their system configuration, and no functional workarounds exist to mitigate the flaw. While Cisco-managed cloud instances received automatic mitigations, on-premises administrators must upgrade to fixed releases, including versions 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1. CISA responded by adding CVE-2026-76504 to its Known Exploited Vulnerabilities catalog, ordering US federal civilian agencies to remediate and assess their environments within a three-day window. Defenders are urged to examine `/var/log/nms/containers/service-proxy/serviceproxy-access.log` for anomalous requests directed at `j_security_check` and inspect `/var/log/nms/vmanage-server.log` for unexpected sessions originating from accounts prefixed with `viptela-reserved-`. Pending patches, network teams should sever direct internet exposure of the management console and restrict inbound access exclusively to verified, trusted IP addresses.
Commentary
Path normalization and URL decoding discrepancies between reverse proxies and application frameworks remain one of the most persistent failure modes in enterprise appliances. In this case, an endpoint filter protecting `/j_security_check` evidently fails to normalize URI-encoded inputs (like `/%6a_security_check`) before evaluating access rules, whereas the underlying framework decodes it before routing, cleanly bypassing the perimeter authorization check. For threat actors, Catalyst SD-WAN Manager represents the crown jewels: controlling the central SD-WAN management console grants total visibility and administrative authority over enterprise routing, segment isolation, and WAN edge devices. Attackers can pivot from the controller straight into sensitive branch fabrics without triggering internal host alerts. Network engineering and SOC teams must prioritize log triage prior to applying the update to avoid stomping on transient forensic evidence. Before rebooting or migrating, capture the appliance state using the `request admin-tech` utility to preserve forensic integrity, especially if reverse proxy logs reveal foreign IP addresses probing encoded variants of authentication routes. If WAN management interfaces must remain reachable across boundary networks, immediately gate them behind dedicated VPN concentrators or explicit ingress ACLs.
The Quote to Remember
“This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint.”
“In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability”