# Cisco Catalyst SD-WAN Manager API authentication bypass zero-day (CVE-2026-76504) exploited in the wild

> Cisco disclosed CVE-2026-76504, a CVSS 9.8 authentication bypass in Catalyst SD-WAN Manager (formerly vManage) caused by improper handling of URI encoding in HTTP requests, which Cisco PSIRT confirmed is being actively exploited since September 2026. Fixed releases are available; there is no workaround, and no threat actor has been attributed.

- **Published:** 2026-09-30T00:00:00Z
- **Last reviewed:** 2026-10-06T13:13:28.093Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2820
- **ID:** TL-2026-2820
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-76504

## Description

CVE-2026-76504 (Cisco advisory cisco-sa-sdwan-webauth-xr8beuuU, bug ID CSCww79570, CWE-177 Improper Handling of Multiple Encodings) is a flaw in the API session-based authentication management of Cisco Catalyst SD-WAN Manager. Improper handling of URI encoding in an HTTP request lets a crafted request bypass an authentication rule that is meant to restrict access to a specific API endpoint. An unauthenticated remote attacker who sends such a request can obtain administrative access to the Manager. Cisco rates the flaw CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The advisory states all deployments are affected regardless of configuration.

Cisco PSIRT detected exploitation attempts in September 2026, and the advisory was published on 2026-09-30 (Final, version 1.0). Cisco lists no workaround. It recommends restricting internet access to the system, placing it behind a firewall and allowing only trusted hosts. Cisco-hosted cloud instances were patched automatically in release 20.15.605.

Cisco and BleepingComputer describe the exploit traffic as requests carrying a URI-encoded character, %6a (the letter 'j'), which reaches the j_security_check login handler by a path that skips the authentication rule. Defenders should review /var/log/nms/containers/service-proxy/serviceproxy-access.log and /var/log/nms/vmanage-server.log for j_security_check entries from unknown or unauthorized IPs. They should also look for activity from 'viptela-reserved-' service accounts.

BleepingComputer calls this the fifth actively exploited Cisco SD-WAN zero-day of 2026. The earlier four are CVE-2026-20127, CVE-2026-20182, CVE-2026-20245 and CVE-2026-20262. For CVE-2026-20127, Cisco Talos tracked the exploiting actor as UAT-8616; CISA reported NETCONF-based fabric manipulation and a software-downgrade path to root through CVE-2022-20775. None of that attribution is stated for CVE-2026-76504, so this record treats the actor as unknown. The source material gives no network IOCs, hashes or malware families.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1027 Obfuscated Files or Information
- T1078 Valid Accounts

## Sources

- [Cisco Security Advisory cisco-sa-sdwan-webauth-xr8beuuU](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU)
- [Cisco warns of new SD-WAN authentication bypass zero-day exploited in attacks (BleepingComputer)](https://www.bleepingcomputer.com/news/security/cisco-warns-of-new-sd-wan-authentication-bypass-zero-day-exploited-in-attacks/)
- [NVD - CVE-2026-76504](https://nvd.nist.gov/vuln/detail/CVE-2026-76504)
- [MS-ISAC: Multiple Vulnerabilities in Cisco Catalyst SD-WAN Products Could Allow for Authentication Bypass (context: CVE-2026-20127)](https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-cisco-catalyst-sd-wan-products-could-allow-for-authentication-bypass_2026-016)
- [Help Net Security: Threat actor leveraged Cisco SD-WAN zero-day since 2023 (CVE-2026-20127)](https://www.helpnetsecurity.com/2026/02/25/cisco-sd-wan-zero-day-cve-2026-20127/)
- [NVD - CVE-2026-20127 (earlier SD-WAN zero-day)](https://nvd.nist.gov/vuln/detail/CVE-2026-20127)
- [NVD - CVE-2026-20182 (earlier SD-WAN zero-day)](https://nvd.nist.gov/vuln/detail/CVE-2026-20182)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2820