Cisco disclosed on September 30 that attackers are actively exploiting CVE-2026-76504, a critical authentication bypass in Catalyst SD-WAN Manager. The flaw lets an unauthenticated remote attacker reach the management API with administrator privileges, putting organizations that run vulnerable SD-WAN control systems at risk. Cisco rates the vulnerability 9.8 on the CVSS scale and has released fixes. Its advisory does not identify victims or quantify the number of affected deployments.

Catalyst SD-WAN Manager, formerly called vManage, is the central console for managing Cisco SD-WAN devices. Cisco said its product security team learned of exploitation in September while resolving a Technical Assistance Center case. A September 30 advisory from the Center for Internet Security also describes the flaw as exploited in the wild. The issue affects the Manager product regardless of its configuration; Cisco says no other products are known to be vulnerable.

According to Cisco, the weakness lies in API session authentication and improper handling of URI encoding. A crafted HTTP request containing an encoded character can evade a rule intended to protect a specific API endpoint. Successful exploitation grants access to that API as the admin user without valid credentials. Cisco has not published a full account of the observed attacks or attributed them to a threat actor.

Cisco provided indicators for incident review rather than a list of attacker IP addresses. One example encodes the letter j as %6a in requests to the j_security_check path, although Cisco cautions that an encoded character other than j can also trigger the flaw. Administrators should examine serviceproxy-access.log and vmanage-server.log for related requests from unknown or unauthorized IP addresses. Cisco notes that similar log entries can appear during normal operations, so findings require investigation.

Cisco lists the first fixed releases as 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1; systems older than 20.9 must migrate to a fixed release. The company says there is no workaround that fully addresses the vulnerability. For on-premises systems, it recommends limiting management access from untrusted networks and allowing only known hosts while upgrades are arranged. Cisco says its cloud-managed release 20.15.605 is fixed and requires no customer action.

Organizations running Catalyst SD-WAN Manager should match their installed version against Cisco’s advisory, install the relevant fixed release and review management API logs for signs of unauthorized access. Cisco recommends preserving diagnostic files and contacting its Technical Assistance Center if compromise is suspected. Continued monitoring matters because Cisco has confirmed exploitation but has not disclosed how many systems were targeted.