Cisco SD-WAN Zero-Day (CVE-2026-76504) Exploited in Wild

Executive Summary

Cisco has released an emergency security advisory for a critical, actively exploited zero-day vulnerability in its Cisco Catalyst SD-WAN Manager. The vulnerability, tracked as CVE-2026-76504, is an authentication bypass flaw with a CVSS score of 9.8 (Critical). It allows an unauthenticated, remote attacker to gain administrative privileges on an affected system by sending a crafted HTTP request. Cisco's Product Security Incident Response Team (PSIRT) confirmed active exploitation in the wild. In response, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to patch. There are no workarounds, and all organizations are urged to apply the available software updates immediately.

Vulnerability Details

CVE-2026-76504 stems from the improper handling of URI encoding in HTTP requests sent to the API of a Cisco Catalyst SD-WAN Manager instance. An attacker can craft a specific HTTP request with manipulated URI encoding to bypass the system's authentication and authorization checks.

A successful exploit grants the attacker the same privileges as the admin user, which by default provides complete control over the SD-WAN fabric. This includes the ability to view, modify, or delete configurations, monitor traffic, and potentially pivot to other network devices managed by the SD-WAN Manager.

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None

Affected Systems

The vulnerability affects the following releases of Cisco Catalyst SD-WAN Manager:

• 20.9 and earlier
• 20.12 and earlier
• 20.15 and earlier
• 20.18 and earlier
• 26.1 and earlier
• 26.2 and earlier

Any organization utilizing these versions, especially if the management interface is exposed to the internet, is at immediate risk of compromise.

Exploitation Status

Cisco PSIRT discovered the exploitation while investigating a customer support case in September 2026. The active, in-the-wild exploitation demonstrates that threat actors have developed a reliable method to leverage this flaw. The low complexity of the exploit means that once technical details are widely disseminated, a significant increase in attacks from various actors is highly probable. CISA's inclusion of CVE-2026-76504 in the KEV catalog on September 30, 2026, reinforces the severity and active threat posed by this vulnerability.

Impact Assessment

The impact of a successful exploit is severe. Gaining administrative control over the Catalyst SD-WAN Manager effectively gives an attacker the "keys to the kingdom" for an organization's wide area network. An attacker could:

• Re-route traffic for man-in-the-middle attacks or eavesdropping.
• Disrupt network operations, causing widespread outages.
• Weaken security policies across the entire SD-WAN fabric.
• Use the manager as a launchpad to attack other connected branch offices and data centers.

For any organization reliant on its WAN for business operations, a compromise of the central management plane represents a critical business continuity and security risk.

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns to identify potential exploitation attempts:

Detection & Response

Organizations should focus on identifying signs of compromise and ensuring a swift response.

1. Web Log Analysis: D3-WSAA: Web Session Activity Analysis. Scrutinize web access logs for the Catalyst SD-WAN Manager. Look for suspicious HTTP requests, particularly those with unusual URI encoding patterns targeting the API. Correlate successful API access from untrusted IP addresses with the vulnerability's discovery timeline.
2. Audit Configuration Changes: Review all configuration changes within the SD-WAN Manager. Investigate any unauthorized or unexpected modifications to routing policies, security settings, or device configurations. An attacker with admin access would likely alter configurations to establish persistence or redirect traffic.
3. User Account Review: D3-LAM: Local Account Monitoring. Examine the SD-WAN Manager for any newly created administrative accounts or modifications to existing accounts. Attackers often create their own accounts for persistent access.

Remediation Steps

There are no workarounds for this vulnerability. Patching is mandatory.

1. Apply Updates: D3-SU: Software Update. Immediately upgrade all Cisco Catalyst SD-WAN Manager instances to a fixed software release as detailed in the Cisco security advisory.
2. Restrict Access: As a best practice and compensating control, ensure the management interface of the Catalyst SD-WAN Manager is not exposed to the public internet. Access should be restricted to a secure, internal management network and controlled via strict firewall rules.
3. Assume Compromise: For any internet-exposed managers, organizations should assume they have been compromised. After patching, conduct a thorough audit of all configurations, user accounts, and logs to identify and remediate any malicious changes made by attackers.