CVE-2026-76504: a Cisco SD-WAN Manager authentication bypass that needs no credential

A network controller that manages branch connectivity is one of the devices an attacker would choose first. Cisco confirmed exploitation of CVE-2026-76504 in Catalyst SD-WAN Manager on 30 September 2026, the same day CISA added it to the KEV catalog, with a federal remediation deadline of 3 October 2026. The severity is 9.8, and the flaw is an authentication bypass in the API session path.

What the flaw is

The vulnerability concerns authentication handling in the API session of Catalyst SD-WAN Manager. A crafted request using encoded characters bypasses the check and reaches administrative API functionality as an authenticated caller. Cisco notes there is no alternative mitigation, so the software update is the only remediating action.

Why the SD-WAN controller is the target

The manager is the system that pushes configuration and policy to the routers and gateways across a distributed network. Administrative access to it is not local privilege on a single device; it is the ability to change routing, segmentation and access policy for the whole environment. An attacker who reaches that position can redirect traffic, add a tunnel, or disable a control, and the change looks like an authorised configuration update.

The pattern this belongs to

This is the fourth time this year that CISA has added a Catalyst SD-WAN Manager or Controller flaw to the KEV catalog, following earlier entries in February and June 2026. A product returning to the exploited list this often is a signal about the security model of the platform, not only about individual bugs. Management planes reachable from the internet and authenticated by the same service they manage concentrate a large amount of authority behind one check.

What to do

Update to the fixed releases Cisco published for Catalyst SD-WAN Manager. Because there is no alternative mitigation, exposure cannot be reduced by configuration alone.
Since exploitation is confirmed, treat deployment as an investigation as well. Review logs for access to the API paths involved from unexpected sources, and look for configuration changes that no administrator or automation made. Given the authority the controller holds, credentials it could reach should be considered for rotation after any confirmed compromise.

References

• iThome reporting on the Catalyst SD-WAN Manager patch and KEV addition, 1 October 2026, https://www.ithome.com.tw/news/179329
• Cisco security advisory for CVE-2026-76504, as summarised in the daily security intelligence report, https://blog.csdn.net/weixin_45635831/article/details/166945207