CVE-2026-76504: Cisco SD-WAN Manager auth bypass exploited

📌 Later developments: Cisco SD-WAN Manager: no workaround, check for compromise (October 1, 2026)

On 30 September 2026 Cisco published security advisory cisco-sa-sdwan-webauth-xr8beuuU for CVE-2026-76504, a vulnerability in Cisco Catalyst SD-WAN Manager that allows API authentication to be bypassed. According to the vendor, the vulnerability is already being actively exploited. On the same day CISA added it to the Known Exploited Vulnerabilities (KEV) catalogue, with a 3 October 2026 deadline for US federal agencies.

In the following days several national CSIRTs published their own advisories: the Dutch NCSC (NCSC-2026-0395), the Finnish NCSC at Traficom, CERT-FR at ANSSI (CERTFR-2026-AVI-1246) and the Canadian Centre for Cyber Security (AV26-978).

What happened

Catalyst SD-WAN Manager is the central console used to configure and manage a Cisco SD-WAN network. The vendor advisory describes an API authentication bypass: a remote attacker without credentials can gain access to the management interface.

The Finnish NCSC rates the vulnerability as critical, with a CVSS 3.1 score of 9.8, and explains that it allows remote control of the system with administrator privileges without any authentication. CERT-FR summarises the risk as a security policy bypass and reports that Cisco lists the vulnerability as actively exploited.

Technical details

• CVE: CVE-2026-76504, CVSS 3.1 9.8 according to the Finnish NCSC.
• Product: Cisco Catalyst SD-WAN Manager. According to the Finnish NCSC, every installation running an unfixed version is affected, regardless of configuration.
• Root cause: according to the Finnish advisory, the flaw lies in incorrect handling of URI encoding in the API authentication check. A crafted API request evades the authentication rule and reaches the API without the normal checks. In the KEV catalogue the vulnerability is listed as “Hex Encoding Vulnerability”.
• Vector: network, remote and unauthenticated.
• Described effects: access to the management interface, administrator-level privileges and full control of the SD-WAN environment.
• Exploitation: confirmed by Cisco. For now the KEV catalogue does not list any known use in ransomware campaigns (“Unknown”).
• MITRE ATT&CK: when the Manager is reachable from the Internet, exploitation falls under T1190 (Exploit Public-Facing Application).
• Indicators: Cisco has published indicators of compromise in its advisory, useful to determine whether a system has already been breached.

Fixed versions

The fixes are included in these versions and later ones:

• 20.9.10.1;
• 20.12.8.2;
• 20.15.6.1;
• 20.18.4.1;
• 26.1.2.1;
• 26.2.1.

Versions earlier than 20.9 must be migrated to a supported, fixed release.

Impact for European and Italian companies

An SD-WAN connects offices, branches and data centres, and the Manager is its command point: whoever takes control of it with administrator privileges controls the network configuration of every managed site. That is why the risk is high above all for organisations with many sites, including healthcare providers with several facilities, where the network between sites can also carry access to clinical systems.

The Finnish NCSC points out that the risk is particularly high for systems reachable directly from the Internet or with ports open to the public network.

For entities in scope of NIS2, a compromise of the console that governs the wide-area network may become an incident to assess for notification to the national CSIRT, which in Italy is CSIRT Italia at ACN. An exploited vulnerability listed in KEV is also a textbook case in which vulnerability management must show documented priorities and remediation times.

What to do now

1. Find your instances: list every Catalyst SD-WAN Manager, including lab and disaster recovery ones, and check the installed version.
2. Update without waiting: move each instance to one of the fixed versions listed or a later one. If you are on a version earlier than 20.9, plan the migration to a supported release straight away.
3. Reduce exposure, as Cisco recommends:
   • remove direct Internet access to the Manager;
   • allow management connections only from known IP addresses;
   • protect the system with a firewall.
4. Look for signs of compromise: check your systems against the indicators published in the Cisco advisory and review the environment’s logs, particularly calls to the management APIs from unexpected addresses.
5. Check for changes: if you find signs of unauthorised access, review administrative accounts and recent changes to the SD-WAN configuration, and treat the event as a possible incident.
6. Keep watching the logs: keep monitoring the environment after the update too, as Cisco advises.

How ARXDOME helps

ARX Expose shows which services your company exposes on the Internet, which products are recognised on them and which have known vulnerabilities: it helps you find out whether a management interface such as the SD-WAN Manager’s is reachable from outside. ARX Sentry collects the logs of firewalls and other network devices in a central collector, so anomalous access at the perimeter stays in front of the analysts. ARX Horizon lets you look up vulnerabilities and search for indicators of compromise from the portal.

Last updated: 1 October 2026