Your SD-WAN Manager has a Saturday deadline — and attackers already have admin

Cisco confirmed active exploitation of a critical authentication bypass in Catalyst SD-WAN Manager. An unauthenticated attacker who can reach the Manager API can land with admin privileges. CISA added the flaw to KEV on September 30 and set the federal due date for Saturday, October 3 — with forensic triage required under BOD 26-04.

If your WAN control plane still sits on an unpatched Manager, Thursday morning is the window to inventory, collect forensics, and schedule the cutover before that Saturday clock.

Whoever owns your SD-WAN Manager owns every edge it configures. Attackers already know the bypass.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

What happened

On September 30, 2026, Cisco published advisory cisco-sa-sdwan-webauth-xr8beuuU for CVE-2026-76504. The bug is improper handling of URI encoding in an HTTP request to the Manager API. That encoding lets a request bypass a session-based authentication rule meant to protect a specific endpoint. The result is remote, unauthenticated admin API access. Cisco rates it critical (CVSS 9.8) and says the Product Security Incident Response Team became aware of active exploitation in September 2026.

Every Catalyst SD-WAN Manager deployment is affected regardless of configuration. There is no workaround that closes the auth gap. Cisco’s temporary mitigation for on-prem Managers that must stay online is to keep the management plane off untrusted networks — filter to known trusted hosts and follow the Catalyst SD-WAN Hardening Guide. Cloud-hosted environments already apply that network control.

CISA added CVE-2026-76504 to the Known Exploited Vulnerabilities catalog the same day and ordered federal civilian agencies to remediate by October 3, 2026. BOD 26-04 marks forensic triage as Yes. This is the fifth actively exploited Catalyst SD-WAN zero-day Cisco has disclosed in 2026.

Why it matters

SD-WAN Manager is the control plane for the WAN. Admin API access means an attacker can read topology, push policy, and plant persistence across thousands of edges from one dashboard. Cisco documents Managers that can oversee up to 6,000 devices.

The Saturday federal clock is real for agencies and a useful forcing function for everyone else. Prior advisories in this series warned that upgrading alone may not clear a confirmed compromise — collect admin-tech first, then patch, then hunt.

What to do first

• Inventory every Manager. List on-prem and cloud-hosted Catalyst SD-WAN Manager instances and their release trains (20.9, 20.12, 20.15, 20.18, 26.1, 26.2, or older).
• Collect forensics before the upgrade. Run request admin-tech on each Manager. Open a Severity 3 Cisco TAC case titled with CVE-2026-76504 if you need help reviewing compromise.
• Upgrade to a fixed release. First fixed builds: 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, 26.2.1. Anything earlier than 20.9 must migrate to a fixed train. Use Cisco’s Control Component Compatibility Matrix before cutover.
• Hunt the URI encoding IOC. Cisco warns actors use %6a (hex for “j”) in malicious requests. Check serviceproxy-access.log under /var/log/nms/containers/service-proxy and vmanage-server.log under /var/log/nms/ for j_security_check from unknown IPs.
• Shrink exposure. Keep Manager management interfaces off the public internet. Allow only trusted jump hosts until the upgrade is complete and verified.

Details

• CVE: CVE-2026-76504 (Cisco Catalyst SD-WAN Manager URI/hex encoding auth bypass)
• Impact: Unauthenticated remote admin API access; all deployments regardless of config
• CVSS: 9.8 (Cisco / industry reporting)
• Advisory: cisco-sa-sdwan-webauth-xr8beuuU (Sep 30, 2026)
• KEV: Added Sep 30, 2026; federal due date Oct 3, 2026; BOD 26-04 forensic triage Yes
• Fixed releases: 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, 26.2.1; earlier than 20.9 → migrate
• Workaround: None that closes the auth gap; network filtering of management plane only
• IOC hint: %6a in URI; review j_security_check in serviceproxy-access.log and vmanage-server.log

Hunt / verify

• Confirm Manager software version against the fixed-release table before closing the change.
• Grep serviceproxy-access.log and vmanage-server.log for %6a, unusual j_security_check, and admin API calls from unexpected source IPs since at least early September.
• Diff recent template / policy / device changes against known-good change tickets.
• Verify Manager UI and API are reachable only from approved management networks.

Cisco SD-WAN Manager CVE-2026-76504 actively exploited — upgrade to fixed build by Sat Oct 3, collect admin-tech first, hunt %6a / j_security_check in NMS logs, keep Manager off the public internet.

Sources

• Cisco Security Advisory: cisco-sa-sdwan-webauth-xr8beuuU (CVE-2026-76504)
• BleepingComputer: Cisco warns of new SD-WAN zero-day exploited in attacks (Sep 30, 2026)
• The Hacker News: Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager (Sep 30, 2026)
• CISA: Adds CVE-2026-76504 to KEV Catalog (Sep 30, 2026)

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].