{"id":"cisco-sdwan-manager-auth-bypass-sep-2026","category":"patch","status":"closed","title":"Cisco Catalyst SD-WAN Manager login bypass CVE-2026-76504 used in attacks; fixes released","tldr":"Cisco SD-WAN Manager has a critical login bypass (CVE-2026-76504) that attackers have been using since September. Fixes exist for every supported release. Businesses should upgrade now, keep the console off the internet and have Cisco check for compromise.","summary":"Cisco Catalyst SD-WAN Manager, the central console used to manage a company's SD-WAN network, has a critical flaw, CVE-2026-76504, rated 9.8 out of 10. An attacker on the internet can send a specially crafted web request, built around how the product handles URL encoding, and get administrator-level access to the Manager's API without a password. Cisco says its incident responders found the flaw being used in attacks in September 2026 while working a support case, and published its advisory on 30 September 2026. CISA listed it as exploited the same day. Cisco has not named the attackers or said how many systems were hit, and Help Net Security reports it is the fifth SD-WAN flaw Cisco has disclosed as exploited this year. Fixed releases are 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1. Versions earlier than 20.9 must move to a fixed release. No workaround exists. Cisco has already fixed its cloud-hosted service. A 2 October update added a temporary partial shield.","action":"If your business runs Cisco SD-WAN Manager, upgrade to the fixed release for your version and keep the console off the internet. Before upgrading, collect the admin-tech file and open a Cisco TAC case with CVE-2026-76504 in the title to check for compromise. Home users don't run this.","product":"Cisco Catalyst SD-WAN Manager","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-76504"],"tags":["cisco","sd-wan","authentication-bypass","zero-day","cisa-kev","network-management"],"affected":["Cisco Catalyst SD-WAN Manager releases 26.2, 26.1, 20.18, 20.15, 20.12, 20.9 and earlier than 20.9, regardless of configuration"],"fixed":["20.9.10.1","20.12.8.2","20.15.6.1","20.18.4.1","26.1.2.1","26.2.1","SD-WAN Cloud (Cisco Managed) 20.15.605"],"matches":[],"sources":[{"kind":"advisory","title":"Cisco Catalyst SD-WAN Manager API Authentication Bypass","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU","by":"Cisco","date":"2026-10-02"},{"kind":"news","title":"New Cisco SD-WAN zero-day exploited in-the-wild (CVE-2026-76504)","url":"https://www.helpnetsecurity.com/2026/10/01/new-cisco-sd-wAN-zero-day-exploited-in-the-wild-cve-2026-76504/","by":"Help Net Security","date":"2026-10-01"}],"started":"2026-09-30","closed":"2026-10-02","created":"2026-11-03T22:07:18.223Z","updated":"2026-11-03T22:07:18.223Z","cve_notes":[{"cve":"CVE-2026-76504","name":"Login bypass in Cisco SD-WAN Manager API","what":"An authentication bypass in the API of Cisco Catalyst SD-WAN Manager, caused by improper handling of URL encoding, that lets a remote attacker with no password gain administrator-level access.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-10-02","added":"2026-11-03T22:05:27.736Z","kind":"vendor-revised","text":"Cisco revised its advisory (version 1.1) to add a Live Protect shield. It gives only temporary, partial protection and may stop users who use URI encoding from logging in.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU","by":"Cisco","patch":null},{"at":"2026-09-30","added":"2026-11-03T22:05:27.736Z","kind":"cisa-added","text":"CISA added CVE-2026-76504 to its list of vulnerabilities being used in attacks. US federal civilian agencies were told to fix it and assess for compromise by 3 October 2026.","url":"https://www.helpnetsecurity.com/2026/10/01/new-cisco-sd-wAN-zero-day-exploited-in-the-wild-cve-2026-76504/","by":"Help Net Security","patch":null},{"at":"2026-09-30","added":"2026-11-03T22:05:27.736Z","kind":"disclosed","text":"Cisco published its advisory for CVE-2026-76504, a critical (CVSS 9.8) login bypass in Catalyst SD-WAN Manager. Cisco said its PSIRT knew of active exploitation in September 2026 and listed fixed releases for each supported train, with no workaround.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU","by":"Cisco","patch":"patched"}],"url":"https://hard.fyi/live/cisco-sdwan-manager-auth-bypass-sep-2026/","json":"https://hard.fyi/api/live?id=cisco-sdwan-manager-auth-bypass-sep-2026"}