An actively exploited flaw in how Cisco Catalyst SD-WAN Manager handles URI encoding lets an unauthenticated remote attacker reach its API with admin privileges, and CISA has given federal agencies until October 3, 2026 to act.
What Is It
CVE-2026-76504 is in the API session-based authentication management of Cisco Catalyst SD-WAN Manager. CISA lists it as the "Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability."
The product mishandles URI encoding in HTTP requests. Because of that, a crafted request can get past an authentication rule meant to restrict access to a specific API endpoint. An attacker who sends such a request to the API can skip authentication and use the API as the admin user. The weakness is classified as CWE-177.
Why It Matters
- Severity: CVSS 3.1 base score of 9.8 (CRITICAL), vector
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It can be exploited over the network, is not complex to exploit, and needs no privileges or user interaction. - Active exploitation confirmed: CISA added the CVE to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-30. CISA's SSVC assessment rates exploitation as "active," automatable as "yes," and technical impact as "total."
- Forensic triage required: The KEV entry is flagged for forensic triage. That means CISA expects organizations to check for compromise, not just patch.
- Ransomware use: Listed as "Unknown."
SD-WAN Manager is the system that manages the SD-WAN. Admin access to its API could let an attacker change the configuration of the network built on it, depending on how the deployment is set up and which functions that API exposes.
What's Vulnerable
NVD's configuration data marks these Cisco Catalyst SD-WAN Manager versions as vulnerable:
- All versions before 20.9.10.1
- 20.12 up to (not including) 20.12.8.2
- 20.15 up to (not including) 20.15.6.1
- 20.18 up to (not including) 20.18.4.1
- 26.1 up to (not including) 26.1.2.1
- 26.2
Cisco PSIRT's affected-version list also includes older releases in the 17.2.x, 18.2.x, 18.3.x and 18.4.x trains.
Patch Status
The NVD ranges end at 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1 and 26.1.2.1. For release 26.2, no fixed version is given. Check the exact fixed releases and mitigations against Cisco's advisory, which NVD tags as both "Vendor Advisory" and "Mitigation."
CISA's required action:
- Apply mitigations according to the vendor's instructions, in line with BOD 26-04 and CISA's Forensics Triage Requirements.
- Follow the BOD 26-04 guidance for cloud services, or stop using the product if no mitigations are available.
- Evaluate each asset's internet exposure.
Federal due date: 2026-10-03.