#SD-WAN

In-the-Wild Exploitation Targets Cisco Catalyst SD-WAN via Critical URL-Encoding Auth Bypass

Cisco has released emergency updates to patch a critical authentication bypass flaw affecting Catalyst SD-WAN Manager, tracked as CVE-2026-76504 with a maximum CVSS v3.1 score of 9.8. The vulnerability is classified under CWE-177 and stems from improper handling of URI-encoded characters during session-based API authentication processing. By issuing a crafted HTTP request with encoded paths—such as swapping a standard character for `%6a` targeting the `j_security_check` endpoint—an unauthenticated remote attacker can bypass authentication controls. Successful exploitation grants the attacker full administrative access to the underlying management API without requiring valid credentials or user interaction. Cisco discovered the issue in September 2026 after active exploitation was identified during a Technical Assistance Center support engagement. All Catalyst SD-WAN Manager deployments are affected regardless of their system configuration, and no functional workarounds exist to mitigate the flaw. While Cisco-managed cloud instances received automatic mitigations, on-premises administrators must upgrade to fixed releases, including versions 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1. CISA responded by adding CVE-2026-76504 to its Known Exploited Vulnerabilities catalog, ordering US federal civilian agencies to remediate and assess their environments within a three-day window. Defenders are urged to examine `/var/log/nms/containers/service-proxy/serviceproxy-access.log` for anomalous requests directed at `j_security_check` and inspect `/var/log/nms/vmanage-server.log` for unexpected sessions originating from accounts prefixed with `viptela-reserved-`. Pending patches, network teams should sever direct internet exposure of the management console and restrict inbound access exclusively to verified, trusted IP addresses.