CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV — hejes.my

CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-76504, a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager, to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation in the wild. Cisco has released patches, but there are no workarounds for this flaw.

What is the vulnerability?

CVE-2026-76504 is an API authentication bypass in Cisco Catalyst SD-WAN Manager (formerly vManage). The root cause is improper handling of URI encoding in an HTTP request, which allows a crafted request to bypass an authentication rule intended to restrict access to a specific API endpoint. An unauthenticated, remote attacker can exploit this by sending a crafted HTTP request to the API of an affected system, gaining access with privileges of the admin user.

The vulnerability affects Cisco Catalyst SD-WAN Manager regardless of system configuration. Cisco's advisory confirms there are no workarounds, and the only effective remediation is upgrading to a fixed software release. Cisco has also released Snort Rule 67179 to help detect exploitation attempts.

Exploitation status

Cisco became aware of active exploitation of CVE-2026-76504 in September 2026. CISA subsequently added it to the KEV catalog on 30 September 2026 with a remediation due date of 3 October 2026 for Federal Civilian Executive Branch (FCEB) agencies. Multiple security organisations, including New Zealand's NCSC and NHS England, have also assessed active or likely exploitation.

At the time of disclosure, Cisco did not provide specific details about who is exploiting the vulnerability, the scale of compromises, or when exploitation began. However, the fact that it has been added to KEV with a short remediation window underscores the urgency of addressing it.

Affected versions and fixed releases

Customers running vulnerable versions of Cisco Catalyst SD-WAN Manager should upgrade to the appropriate fixed release. Cisco has published the following fixed versions by release train:

For Cisco SD-WAN Cloud (Cisco Managed) customers running Release 20.15.605, the fix has already been deployed and no action is required. Customers can verify their current version using the Help function in the service GUI.

What to do if compromised or at risk

Cisco recommends that customers upgrade affected systems to a fixed software release as soon as possible. For help determining if a system has been compromised, organisations can open a Severity 3 case with Cisco Technical Assistance Center (TAC) with "CVE-2026-76504" in the title. Before doing so, Cisco recommends running request admin-tech from Cisco Catalyst SD-WAN Manager (vManage) and providing the resulting admin-tech file to TAC for review.

To detect potential exploitation, organisations should look for POST requests to URL-encoded variants of /j_security_check and review logs for suspicious activity. Cisco's advisory provides specific log locations and guidance for investigating potential compromises.

Mitigations and urgency

With no workarounds available, patching is the only viable path to remediation. CISA's BOD 26-04 deadline of 3 October 2026 for federal agencies should be treated as a strong signal for all organisations running internet-exposed or business-critical SD-WAN Manager instances. Given confirmed active exploitation and the high CVSS score of 9.8, unpatched systems should be considered at immediate risk and prioritised for upgrades.

Sources

• Cisco: Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability
• The Hacker News: CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV
• CISA: CISA Known Exploited Vulnerabilities Catalog