Critical [CVE-2026-76504] Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability
This critical-severity Cisco advisory covers CVE-2026-76504 affecting Catalyst SD-WAN Manager.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Cisco CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
An unauthenticated remote attacker could exploit a flaw in the API session-based authentication management of Cisco Catalyst SD-WAN Manager to access an affected system with privileges of the admin user.
The flaw is caused by improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint.
Cisco has released a Live Protect shield for CVE-2026-76504 to provide temporary security coverage to allow time for software upgrade planning, including preserving any information that customers may require for governance or compliance purposes.
CISA Known Exploited Vulnerability
- Listed:
- Sep 30, 2026 · federal remediation due Oct 3, 2026
- Required action:
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Ransomware use:
- Unknown
KEV is a prioritization signal from CISA — remediation detail still comes from the vendor advisory.
- Scope: This vulnerability affects Cisco Catalyst SD-WAN Manager, regardless of system configuration.
- Earlier than 20.9 — Migrate to a fixed release
- Release 20.9 (first fixed: 20.9.10.1)
- Release 20.12 (first fixed: 20.12.8.2)
- Release 20.15 (first fixed: 20.15.6.1)
- Release 20.18 (first fixed: 20.18.4.1)
- Release 26.1 (first fixed: 26.1.2.1)
- Release 26.2 (first fixed: 26.2.1)
Official advisory · high-confidence parse· fetched 18 hours ago·verify at source
- 20.9.10.1
- 20.12.8.2
- 20.15.6.1
- 20.18.4.1
- 26.1.2.1
- 26.2.1
Official advisory · high-confidence parse· fetched 18 hours ago·verify at source
Mitigation checklist
- Upgrade to the first fixed release for your train per the Fixed Releases table in this advisory.
- Earlier than 20.9: migrate to a fixed release.
- Release 20.9: upgrade to 20.9.10.1.
- Release 20.12: upgrade to 20.12.8.2.
- Release 20.15: upgrade to 20.15.6.1.
- Release 20.18: upgrade to 20.18.4.1.
- Release 26.1: upgrade to 26.1.2.1.
- Release 26.2: upgrade to 26.2.1.
- There are no workarounds that address this vulnerability. However, as a mitigation for On-Prem deployment customer environments, they should restrict access from unsecured networks, such as the internet, to the system. If access to the system is required from the internet, restrict system access to only known, trusted hosts on ports and protocols that are included in the user guides. Protect Ci…
- For Cisco Catalyst SD-WAN Cloud Hosted environments, this mitigation is already deployed.
Official advisory · high-confidence parse· fetched 18 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.