CISCO Security Advisory
Published Date: Not specified
CVE: CVE-2026-76504
Advisory Summary
🗓️ Calendar: Sep 30, 2026
🚨 ⚠️ Critical Alert: Cisco Catalyst SD-WAN Manager API Authentication Bypass (CVE-2026-76504)
An unauthenticated, remote attacker could bypass session-based API authentication controls in Cisco Catalyst SD-WAN Manager, potentially gaining admin-level privileges via a crafted HTTP request.
- Improper handling of URI encoding in an HTTP request
- This allows a request to bypass an authentication rule meant to restrict access to a specific API endpoint
- Remote attacker reaches the affected system as the admin user
- This can lead to full compromise of management-plane functionality (e.g., configuration, monitoring, and potentially downstream SD-WAN orchestration)
- Send a specially crafted HTTP request to the SD-WAN Manager API
- Successful bypass results in authenticated API access without legitimate credentials
- Software updates are available to remediate the issue
- No workarounds are provided for this vulnerability
- Restrict management/API interfaces to trusted networks (VPN/allowlists)
- Ensure no public reachability unless absolutely required
- Confirm patched version levels per Cisco advisory
- Monitor logs for anomalous unauthenticated API access attempts and privilege changes
- CVE-2026-76504
-WAN -2026-76504
Reference: Vendor Advisory