Skip to content
  • There are no suggestions because the search field is empty.

2026-10-01: Cybercriminals can take over Cisco SD-WAN Manager without a password

Cisco Catalyst SD-WAN Manager, the central console many organizations use to run their wide-area networks, has been found to contain an authentication bypass vulnerability that gives cybercriminals administrator access without logging in. They do this by using a single crafted web request and Cisco has confirmed CVE-2026-76504 (9.8 out of 10 CVSS) is already actively exploited.

Read Cisco's security advisory (external link).

How the vulnerability works

Catalyst SD-WAN Manager, formerly known as vManage, is the control room for a software-defined wide-area network (SD-WAN). SD-WAN links a company's offices, data centers, and cloud services, and is managed centrally through software. Administrators and other tools send commands to the Manager through its API.

According to Cisco's advisory, the Manager mishandles URI encoding, the way special characters in a web address are rewritten as codes, such as %2F for a slash. A rule meant to block unauthenticated requests to one API endpoint checks the address as written. Encode the same address differently, and the request slips past the rule.

Why this is dangerous

Cybercriminals need no password, no account and no help from an employee. One request gives them access to the API as the admin user.

The admin account is the most powerful account on the Manager. The Manager in turn holds the configuration for the routers at every connected site and the policies that decide which traffic goes where. Taking it over hands control of the network's backbone to whoever sent the request.

Cisco's Product Security Incident Response Team says it became aware of active exploitation in September 2026. Cisco hasn't named those responsible or shared details of the attacks.

Affected software

On-premises Cisco Catalyst SD-WAN Manager is affected regardless of how it's configured, so no setting protects an unpatched system. These releases are vulnerable:

  • Releases earlier than 20.9
  • 20.9 before 20.9.10.1
  • 20.12 before 20.12.8.2
  • 20.15 before 20.15.6.1
  • 20.18 before 20.18.4.1
  • 26.1 before 26.1.2.1
  • 26.2 before 26.2.1

                Cisco has already mitigated its cloud-hosted SD-WAN deployments.

                Mitigation & next steps

                Cisco urges customers to upgrade to:

                • 20.9.10.1
                • 20.12.8.2
                • 20.15.6.1
                • 20.18.4.1
                • 26.1.2.1
                • 26.2.1, or later

                            There's no workaround. Releases earlier than 20.9 won't get a fix, so those customers need to migrate to a fixed release.

                            Until they can patch, Cisco advises customers to:

                            • Restrict access to the Manager from untrusted networks, including the internet
                            • Place SD-WAN control components behind a firewall
                            • Check the serviceproxy-access.log file for URI-encoded requests to j_security_check, a sign that someone has already tried the attack

                                  CISA added the vulnerability to its KEV Catalog on 30 September 2026. It gave federal agencies until 3 October 2026 to act.

                                  See CISA's KEV Catalog entry for CVE-2026-76504 (external link).

                                   

                                  Holm Security’s response

                                  Holm Security has released a test to scan for this vulnerability:

                                  • HID-2-1-5403574 -  Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability (cisco-sa-sdwan-webauth-xr8beuuU) (September 2026)

                                    Scan for specific vulnerabilities

                                    Read how you can include or exclude a specific vulnerability in a scan profile here.