Cisco Warns of Active Exploitation of Critical Authentication Bypass Flaw in SD-WAN Manager

Cisco has warned that attackers are actively exploiting a critical authentication bypass flaw in its Catalyst SD-WAN Manager software, which allows an unauthenticated attacker to reach the Manager's API as the admin user via a specially crafted HTTP request.

The flaw, tracked as CVE-2026-76504 with a CVSS score of 9.8, is caused by improper handling of uniform resource identifier (URI) encoding and affects SD-WAN Manager regardless of system configuration.

Cisco strongly recommends upgrading to fixed releases, starting at 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1, depending on the release train.

Cisco's Product Security Incident Response Team (PSIRT) became aware of active exploitation in September, and customers running anything earlier than 20.9 must migrate to a fixed release.