Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026
cisco-sa-oct2026-node-js-Jj3SQ19u
Summary
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.
This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Live Protect Shield
Cisco has released a Live Protect shield for CVE-2026-76504 to provide temporary security coverage to allow time for software upgrade planning, including preserving any information that customers may require for governance or compliance purposes.
This shield offers only temporary partial protection. The only way to remediate this vulnerability is to upgrade to the first fixed software release, as noted in the Fixed Releases section of this advisory. Cisco strongly recommends prioritizing system upgrades and scheduling them as soon as possible to ensure remediation.
Before deploying the shield, read the following information:
Side Effects/Limitation: If this shield is applied
A legitimate user with URI encoding might not be able to login to SDWAN Manager.
For more information about Live Protect for Cisco Catalyst SD-WAN, see https://www.cisco.com/c/en/us/td/docs/routers/sdwan/26x-later/network-monitoring/network-monitoring-guide/live-protect-for-cisco-catalyst-sd-wan.html.
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
There are no workarounds that address this vulnerability. However, as a mitigation for On-Prem deployment customer environments, they should restrict access from unsecured networks, such as the internet, to the system. If access to the system is required from the internet, restrict system access to only known, trusted hosts on ports and protocols that are included in the user guides.
Protect Cisco Catalyst SD-WAN Control Components behind a filtering device such as a firewall, and filter traffic to and from the system while allowing only known, trusted hosts to send traffic to the system. For more information, see the Cisco Catalyst SD-WAN Hardening Guide.
For Cisco Catalyst SD-WAN Cloud Hosted environments, this mitigation is already deployed.
While this mitigation has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations.
Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.
Fixed Releases
In the following table(s), the left column lists Cisco software releases. The right column indicates whether a release is affected by the vulnerability that is described in this advisory and the first release that includes the fix for this vulnerability. Customers are advised to upgrade to an appropriate fixed software release as indicated in this section.
Cisco Catalyst SD-WAN Software Release | First Fixed Release |
|---|---|
Earlier than 20.9 | Migrate to a fixed release. |
20.9 | 20.9.10.1 |
20.12 | 20.12.8.2 |
20.15 | 20.15.6.1 |
20.18 | 20.18.4.1 |
26.1 | 26.1.2.1 |
26.2 | 26.2.1 |
Cisco has also addressed this vulnerability in Cisco SD-WAN Cloud (Cisco Managed) Release 20.15.605, which is cloud based. No user action is required. Customers can determine the current remediation status or software version by using the Help function in the service GUI.
Customers who need additional information are advised to contact the Cisco TAC or their contracted maintenance providers.
The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.
Additional Information
To check component and software release compatibility, see the Catalyst SD-WAN Control Component Compatibility Matrix.
For help planning an upgrade, see the Cisco Catalyst SD-WAN Upgrade Matrix.
CVEs in this advisory 1
Update history
What changed in later vendor updates
SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.
- The vendor changed the advisory summary.
- The vendor changed the advisory summary.
Updates
- Added to SecurityAlert
We collected the advisory from the official source.
- Published by Cisco
The publication date reported by the vendor.
- Confirmed at the source
Our collector saw this advisory during a later source check.