Cisco warns of new SD-WAN zero-day exploited in attacks
Cisco Catalyst SD-WAN Manager has a critical zero-day vulnerability (CVE-2026-76504) that allows unauthenticated remote attackers to escalate privileges to admin by bypassing API session authentication. The flaw is due to improper URI encoding handling in HTTP requests, enabling attackers to bypass authentication rules. Cisco has released fixed software versions and strongly recommends upgrading. Indicators of compromise include use of the URI-encoded character '%6a' for 'j' in malicious requests. This is the fifth actively exploited SD-WAN zero-day in 2026.
AI Analysis
Technical Summary
CVE-2026-76504 is a critical zero-day vulnerability in Cisco Catalyst SD-WAN Manager's API session-based authentication management. The vulnerability arises from improper handling of URI encoding in HTTP requests, allowing crafted requests to bypass authentication rules intended to restrict access to specific API endpoints. This enables unauthenticated remote attackers to gain admin privileges on affected systems. Cisco confirmed active exploitation in the wild and released security updates to remediate the issue. The vulnerability affects all deployments regardless of system configuration. Cisco provided indicators of compromise and log file locations to assist detection.
Potential Impact
Successful exploitation allows unauthenticated remote attackers to escalate privileges to administrative level on Cisco Catalyst SD-WAN Manager systems. This could lead to full control over the SD-WAN management infrastructure, potentially impacting network management and security. The vulnerability affects all deployments of the product regardless of configuration. Active exploitation has been confirmed by Cisco.
Mitigation Recommendations
Cisco has released fixed software versions to remediate this vulnerability. Customers are strongly advised to upgrade to one of the fixed releases: 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, or 26.2.1. Administrators should also monitor the serviceproxy-access.log and vmanage-server.log files for suspicious 'j_security_check' entries from unknown IP addresses. For assistance in determining compromise, customers may open a case with Cisco TAC and collect admin-tech files to support investigation.
Cisco warns of new SD-WAN zero-day exploited in attacks
Description
Cisco Catalyst SD-WAN Manager has a critical zero-day vulnerability (CVE-2026-76504) that allows unauthenticated remote attackers to escalate privileges to admin by bypassing API session authentication. The flaw is due to improper URI encoding handling in HTTP requests, enabling attackers to bypass authentication rules. Cisco has released fixed software versions and strongly recommends upgrading. Indicators of compromise include use of the URI-encoded character '%6a' for 'j' in malicious requests. This is the fifth actively exploited SD-WAN zero-day in 2026.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-76504 is a critical zero-day vulnerability in Cisco Catalyst SD-WAN Manager's API session-based authentication management. The vulnerability arises from improper handling of URI encoding in HTTP requests, allowing crafted requests to bypass authentication rules intended to restrict access to specific API endpoints. This enables unauthenticated remote attackers to gain admin privileges on affected systems. Cisco confirmed active exploitation in the wild and released security updates to remediate the issue. The vulnerability affects all deployments regardless of system configuration. Cisco provided indicators of compromise and log file locations to assist detection.
Potential Impact
Successful exploitation allows unauthenticated remote attackers to escalate privileges to administrative level on Cisco Catalyst SD-WAN Manager systems. This could lead to full control over the SD-WAN management infrastructure, potentially impacting network management and security. The vulnerability affects all deployments of the product regardless of configuration. Active exploitation has been confirmed by Cisco.
Mitigation Recommendations
Cisco has released fixed software versions to remediate this vulnerability. Customers are strongly advised to upgrade to one of the fixed releases: 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, or 26.2.1. Administrators should also monitor the serviceproxy-access.log and vmanage-server.log files for suspicious 'j_security_check' entries from unknown IP addresses. For assistance in determining compromise, customers may open a case with Cisco TAC and collect admin-tech files to support investigation.
Technical Details
- Classification
- {"confidence":0.78,"severitySource":"heuristic","classifier":"rss-v2"}
Threat ID: 6abd24b92a4e24523d277dee
Added to database: 09/30/2026, 15:03:21 UTC
Last enriched: 09/30/2026, 15:03:29 UTC
Last updated: 09/30/2026, 15:47:53 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.