URI-encoding bypass of API session authentication gives unauthenticated admin access to Cisco Catalyst SD-WAN Manager (CVE-2026-76504)
Cisco published the advisory and fix on 2026-09-30 after its PSIRT observed active exploitation, CISA added it to KEV the same day with a 2026-10-03 remediation deadline, and Cisco's own advisory doubles as a request-level write-up, so an unpatched Manager reachable by an attacker can be taken over as admin without credentials.
Cisco Catalyst SD-WAN Manager (formerly vManage) mishandles URI/hex encoding in HTTP requests, letting a request slip past an API authentication rule. An unauthenticated remote attacker can reach the Manager API with admin-user privileges, giving control over the SD-WAN fabric's management plane.
Affected: Cisco Catalyst SD-WAN Manager < 20.9.10.1; Cisco Catalyst SD-WAN Manager 20.12.x < 20.12.8.2; Cisco Catalyst SD-WAN Manager 20.15.x < 20.15.6.1; Cisco Catalyst SD-WAN Manager 20.18.x < 20.18.4.1; Cisco Catalyst SD-WAN Manager 26.1.x < 26.1.2.1; Cisco Catalyst SD-WAN Manager 26.2
How to Test
Check the running Catalyst SD-WAN Manager release against the affected ranges (anything below 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, or a 26.2 build older than Cisco's first fixed 26.2 release is vulnerable; the flaw applies regardless of device configuration). To look for prior abuse, review Manager web/API access logs for requests to API endpoints whose paths contain unusual hex- or URI-encoded characters and that were served without a preceding login, audit for unexpected admin-user API sessions, new or modified user accounts, and configuration changes pushed to edge devices, and follow CISA's Forensics Triage Requirements referenced in the KEV entry if the Manager was exposed while unpatched.
How to Patch
Upgrade Catalyst SD-WAN Manager to the fixed release for your train: 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, or 26.1.2.1 (for the 26.2 train, upgrade to the first fixed 26.2 release named in Cisco's advisory). Cisco states there are no workarounds; until the upgrade is applied, restrict network access to the Manager's management/API interface to trusted administrative networks only.