Cisco SD-WAN Manager Zero-Day Lets Attackers Skip Login: A Plain-English Briefing
Cisco says CVE-2026-76504 in Catalyst SD-WAN Manager is under active attack. Here is what the flaw does, who must patch, and what to check in logs.
What happened
Cisco has released fixes for a critical authentication bypass in Catalyst SD-WAN Manager (formerly SD-WAN vManage), tracked as CVE-2026-76504. The company’s Product Security Incident Response Team says it learned of active exploitation in September 2026 and is urging customers to upgrade immediately. The product can manage thousands of SD-WAN devices from one console, so a break-in there has wide reach.
How the flaw works
According to Cisco, improper handling of URI encoding in an HTTP request can let an unauthenticated remote attacker bypass an authentication rule meant to protect a specific API endpoint. A crafted request can grant access with admin privileges. The advisory says the issue affects all deployments regardless of configuration.
What to look for
Cisco shared indicators that attackers are encoding the letter “j” as %6a in malicious requests. Teams hunting for compromise should review serviceproxy-access.log under /var/log/nms/containers/service-proxy and vmanage-server.log under /var/log/nms/ for j_security_check activity from unknown IPs. Cisco also advises collecting admin-tech files before opening a TAC case.
Fixed releases and federal deadline
Fixed builds include 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1; earlier than 20.9 should migrate to a fixed line. CISA added CVE-2026-76504 to its Known Exploited Vulnerabilities catalog and set a federal mitigation deadline of October 3, 2026. BleepingComputer notes this is the fifth actively exploited Cisco SD-WAN zero-day reported in 2026.
What this means for your company
- Confirm whether you run Catalyst SD-WAN Manager. Ask your network provider or MSP if any SD-WAN controller in your path is Cisco’s management platform, including cloud-managed options.
- Patch first, then hunt. Move to a fixed release, then review the log paths Cisco named for encoded login probes.
- Keep management planes off the open internet. Even after patching, limit who can reach controller APIs to trusted networks.
Need help reviewing SD-WAN controllers and closing exposed management access? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
This briefing draws on BleepingComputer’s report on Cisco’s Catalyst SD-WAN Manager zero-day.
About The Author
