Cisco Security Advisories guidance
Vendor revision: Oct 2, 2026Cisco has released software updates that address this vulnerability.
Overview
What is CVE-2026-76504?
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.
This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system.
A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.
Source: NVD
- Reported activity
- Cisco Security Advisories · Published Oct 2, 2026
In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.
CISA says:Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.CISA catalog due date Oct 3, 2026
Official advisory
Configuration and update guidance
Cisco Security Advisories · Updated Oct 2, 2026
Affected products and configuration
This vulnerability affects Cisco Catalyst SD-WAN Manager, regardless of system configuration.
For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.
Workarounds and temporary mitigations
There are no workarounds that address this vulnerability. However, as a mitigation for On-Prem deployment customer environments, they should restrict access from unsecured networks, such as the internet, to the system. If access to the system is required from the internet, restrict system access to only known, trusted hosts on ports and protocols that are included in the user guides.
Protect Cisco Catalyst SD-WAN Control Components behind a filtering device such as a firewall, and filter traffic to and from the system while allowing only known, trusted hosts to send traffic to the system. For more information, see the Cisco Catalyst SD-WAN Hardening Guide.
For Cisco Catalyst SD-WAN Cloud Hosted environments, this mitigation is already deployed.
While this mitigation has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations.
Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.
Fixed software
Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.
Fixed Releases
In the following table(s), the left column lists Cisco software releases. The right column indicates whether a release is affected by the vulnerability that is described in this advisory and the first release that includes the fix for this vulnerability. Customers are advised to upgrade to an appropriate fixed software release as indicated in this section.
Cisco Catalyst SD-WAN Software Release | First Fixed Release |
|---|---|
Earlier than 20.9 | Migrate to a fixed release. |
20.9 | 20.9.10.1 |
20.12 | 20.12.8.2 |
20.15 | 20.15.6.1 |
20.18 | 20.18.4.1 |
26.1 | 26.1.2.1 |
26.2 | 26.2.1 |
Cisco has also addressed this vulnerability in Cisco SD-WAN Cloud (Cisco Managed) Release 20.15.605, which is cloud based. No user action is required. Customers can determine the current remediation status or software version by using the Help function in the service GUI.
Customers who need additional information are advised to contact the Cisco TAC or their contracted maintenance providers.
The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.
Additional Information
To check component and software release compatibility, see the Catalyst SD-WAN Control Component Compatibility Matrix.
For help planning an upgrade, see the Cisco Catalyst SD-WAN Upgrade Matrix.
Exploitation status
In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.