CISCO Security Advisory
Published Date: Not specified
CVE: CVE-2026-76504
Advisory Summary
🗓️ Oct 02, 2026
🏷️ Critical 🚨 Cisco Catalyst SD-WAN Manager: Admin-Level API Authentication Bypass (CVE-2026-76504)
⚠️ What’s happening
Cisco reports a Critical vulnerability in the session-based API authentication management of Cisco Catalyst SD-WAN Manager. A remote attacker, without authentication, may craft HTTP requests that bypass an authentication rule due to improper URI encoding handling, ultimately gaining admin-level API access.
- Privilege impact: Potential takeover of management-plane capabilities at admin privilege.
- Exposure risk: Likely relevant wherever SD-WAN Manager APIs are reachable from untrusted networks (directly or via misconfigured access paths).
- Attack simplicity: URI-encoding manipulation suggests a practical path for exploitation once network reachability is present.
- ✅ Software updates released to remediate the issue.
- 🚫 No workaround is provided that mitigates this vulnerability.
- 🛡️ Cisco offers a Live Protect shield for temporary partial protection while upgrades are planned.
- Temporary, partial coverage only—not a substitute for patching.
- Side effect: If the shield is applied, a legitimate user with URI encoding may not be able to log in to SDWAN Manager.
- Recommendation: Prioritize upgrade to the first fixed release per the advisory’s Fixed Releases section.
✅ Action checklist for IT & security teams
1. Inventory exposure: Identify all Catalyst SD-WAN Manager instances and where the API is reachable.
2. Check version & compatibility: Map your deployments to the advisory’s fixed releases.
3. Prioritize patching: Upgrade to the first fixed software release as soon as change windows allow.
4. Plan for operational impact: Validate authentication/URI-encoding behavior (especially if you use clients or integrations that send encoded URIs).
5. Harden access paths: Ensure API endpoints are restricted by network controls (allowlists/VPN/bastion) and least-privilege exposure.
🧾
#
-WAN -2026-76504
Reference: Vendor Advisory