CVE-2026-76504 is a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager's API session-based authentication mechanism. The flaw stems from improper handling of URI encoding in HTTP requests, enabling crafted requests to reach restricted API endpoints and bypass authentication. Exploitation allows remote, unauthenticated attackers to gain administrative privileges on affected systems. Cisco became aware of active exploitation in September 2026 and released urgent patches for affected versions including 26.2.1, 26.1.2.1, 20.18.4.1, 20.15.6.1, 20.12.8.2, and 20.9.10.1. Cisco-managed cloud deployments have also been patched. The US CISA added this vulnerability to its KEV catalog, urging rapid remediation. Cisco provided indicators of compromise and guidance for detection and mitigation.

Successful exploitation grants remote, unauthenticated attackers administrative access to Catalyst SD-WAN Manager appliances, potentially allowing full control over the system's API and management functions. This could compromise network management and configuration integrity. The vulnerability affects all Catalyst SD-WAN Manager deployments regardless of configuration. Active exploitation has been confirmed, increasing the urgency of patching.

Cisco has released official patches for multiple affected versions and strongly recommends immediate upgrade to these fixed releases. Cisco-managed SD-WAN cloud deployments have been patched by Cisco. There are no workarounds. Organizations should apply the vendor-provided patches without delay. Cisco also published indicators of compromise to assist in detecting exploitation attempts. CISA urges federal agencies to patch within three days. Follow Cisco's guidance for hunting suspicious POST requests to URL-encoded variants of '/j_security_check' and review logs for signs of compromise.