Cisco has released fixes for a critical authentication bypass in Catalyst SD-WAN Manager that attackers are already exploiting to take administrator control of the software, BleepingComputer reported Wednesday. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw, CVE-2026-76504, to its list of known exploited vulnerabilities the same day and ordered federal agencies to remediate it by Saturday, Oct. 3.

What Happened

The bug affects Catalyst SD-WAN Manager, the product previously sold as SD-WAN vManage, which can manage up to 6,000 SD-WAN devices from one console. According to Cisco's advisory, as summarized by BleepingComputer and The Hacker News, the Manager's API mishandles URI encoding during login session handling. A crafted HTTP request can therefore get around an authentication rule that was supposed to restrict access to a single API endpoint.

An attacker needs no credentials, only the ability to reach the Manager's API over the network. A successful request grants admin-level access, and the flaw is present regardless of how a deployment is configured. The Hacker News reported a CVSS score of 9.8 out of 10 and noted that the default admin account carries the netadmin role, which permits every operation on the device.

RelatedCISA Orders Agencies to Fix Exploited Palo Alto Firewall and Cisco Email Gateway Flaws by Saturday

Cisco's Product Security Incident Response Team said it learned of active exploitation in September while handling a customer support case. The advisory says observed attack requests use %6a, the URI-encoded form of the letter "j," to sneak past the check. Cisco has not said who is behind the attacks or how many customers were hit.

Fixed releases are 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1. Deployments on releases older than 20.9 have no direct patch and must move to a fixed train.

Why It Matters

SD-WAN Manager is the control point for an organization's wide-area network, pushing configuration and policy to branch routers and edge devices. Administrative access to it effectively puts that network edge in an attacker's hands. Managers reachable from the internet face the greatest exposure, since exploitation requires nothing more than sending a request.

The flaw also extends a difficult year for the product line. BleepingComputer lists four earlier Cisco SD-WAN zero-days exploited in 2026: CVE-2026-20127, an information disclosure bug, in February; CVE-2026-20182, a controller authentication bypass, in May; and CVE-2026-20245 and CVE-2026-20262, both root-level privilege escalation issues, in June. CISA's three-day deadline is unusually short and reflects how quickly it wants agencies to close the hole.

Detection and Mitigation

Until patches are applied, Cisco advises keeping the Manager off untrusted networks such as the internet and, where outside access is unavoidable, allowing only known, trusted hosts. Firewalls in front of control components are recommended.

To look for compromise, administrators should review serviceproxy-access.log under /var/log/nms/containers/service-proxy and vmanage-server.log under /var/log/nms. Cisco says suspicious entries reference j_security_check from unknown or unauthorized IP addresses, may include individually URI-encoded characters and may involve accounts whose names begin with "viptela-reserved-."

What to Watch

Federal civilian agencies face the Oct. 3 deadline, and private operators running internet-facing Managers are under similar pressure. Further signals to track are whether Cisco or a threat intelligence firm attributes the activity, whether victim counts emerge, and whether CISA issues additional guidance on hunting for compromise given the series of SD-WAN zero-days this year.