CVE intelligence

CVE-2026-76504

Vulnerability intelligence

Published Sep 30, 2026Sources checked Sep 30, 2026

9.8CRITICALCVSS out of 10

What this means

Exploitation reported: act now

Cisco Security Advisories reports exploitation in the wild. This is separate from CISA KEV membership.

Public exploit: Not collected. Review the linked vendor advisory and apply the mitigation or fixed release for your affected product.

Cisco Security Advisories: Exploitation reported by Cisco Security Advisories (2026-09-30)

What to do next

Remediation and response

Cisco Security Advisories guidance

Cisco has released software updates that address this vulnerability.

CISA KEVNot listedBased on the latest collected catalog

EPSSUnavailableNo current score collected

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-76504?

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.