Cisco warns SD-WAN Manager flaw is being exploited, with no workaround

Cisco has warned that a critical authentication bypass in its Catalyst SD-WAN Manager software is being actively exploited, with no workaround available for affected systems.

The company’s advisory, reported by iTnews on October 1, 2026, said Cisco’s Product Security Incident Response Team became aware in September of active exploitation of the flaw, tracked as CVE-2026-76504. The vulnerability has a CVSS severity score of 9.8 out of 10.

Catalyst SD-WAN Manager, formerly known as vManage, is used to manage Cisco SD-WAN environments. Cisco said the flaw affects SD-WAN Manager “regardless of system configuration”, according to the iTnews account of the primary advisory.

The vulnerability allows an unauthenticated attacker to access the Manager application programming interface as the admin user by sending a specially crafted HTTP request. Cisco attributed the issue to improper handling of uniform resource identifier encoding, which can allow a request to bypass an authentication rule protecting a specific API endpoint.

According to iTnews, Cisco’s advisory gave an example using the encoded string %6a in place of the letter j, but said any single encoded character could be used. That means searching for one exact string is not a sufficient detection method on its own.

Cisco advised administrators to audit serviceproxy-access.log and vmanage-server.log files. The company said they should look for j_security_check entries from unknown or unauthorised addresses in serviceproxy-access.log, and requests involving users whose names start with “viptela-reserved-” in vmanage-server.log.

Cisco said there are no workarounds. For on-premises customers, the company suggested keeping SD-WAN Manager away from unsecured networks such as the internet as a mitigation. Where internet access is required, Cisco said access should be limited to known and trusted hosts, with control components placed behind a firewall.

The company said any mitigation should be treated as temporary until a fixed release is installed. Fixed releases begin at 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1, depending on the release train. Customers running versions earlier than 20.9 must migrate to a fixed release.

Cisco said customers that suspect compromise can open a Severity 3 case with Cisco’s Technical Assistance Centre, with the CVE in the case title, after running the request admin-tech command.

The company did not identify who was exploiting the flaw, how many customers may be affected, or when attacks began beyond saying exploitation was known in September. Cisco said the bug was found while resolving a support case.

Security vendor Rapid7 also published a blog post describing CVE-2026-76504 as a critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild. Its post is a secondary security account and did not add customer impact figures in the supplied evidence.

Cisco said the vulnerability is separate from CVE-2026-20182, which was fixed in May, and CVE-2026-20245 and CVE-2026-20262, which were fixed in June.