Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager
Summary: Cisco disclosed on September 30 that attackers are actively exploiting CVE-2026-76504, a CVSS 9.8 authentication bypass in Cisco Catalyst SD-WAN Manager that lets an unauthenticated remote attacker use the Manager's API as the admin user by sending a crafted request that URI-encodes a character in the j_security_check login path. Cisco's Product Security Incident Response Team became aware of active exploitation in September 2026, the flaw was found while TAC handled a support case, fixed releases are available with no workaround, and internet-exposed Managers are at risk.
What's compelling: The admin user holds the netadmin role by default, which is allowed to perform all operations on the device, and Cisco's advisory does not say whether upgrading removes an attacker who already has access - so a Manager last patched for the May or June SD-WAN fixes is still exposed and may already be compromised.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-20182CVE-2026-20245CVE-2026-20262CVE-2026-76504
- Related