CVE-2026-76504 affects Cisco Catalyst SD-WAN Manager, the central console that drives an entire Cisco SD-WAN network. Published by NVD on September 30, 2026 and added to CISA's KEV catalog the same day — meaning it's already exploited. CISA's deadline for federal agencies: October 3.
| Field | Value |
|---|---|
| CVSS 3.1 | 9.8 (CRITICAL) |
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD published | 2026-09-30 |
| CISA KEV | added 2026-09-30, due 2026-10-03 |
What the Flaw Does
The flaw sits in the API's session-based authentication handling.
This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule
Put simply: an authentication rule meant to protect a specific API endpoint fails to recognise the request when the URI is encoded in a certain way. The request slips past the check, and the attacker gets API access with admin user privileges. No credentials, remotely.
It's a classic class of flaw: the component that decides (the access rule) and the component that routes (the application server) don't normalise the URL the same way. I won't go further into the mechanism; Cisco's advisory is the reference.
Why It Matters
SD-WAN Manager isn't just another box. It's the management plane of the whole wide-area network:
- it pushes configurations and policies to every SD-WAN router in the estate
- it holds templates, routing and segmentation policies, and often the related secrets
- admin access to its API means changing the behaviour of every site at once
A compromise here can mean traffic redirection, new paths between isolated segments, or entire sites taken offline.
Versions
NVD lists the following bounds:
| Branch | NVD bound |
|---|---|
| 20.9 | 20.9.10.1 |
| 20.12 | 20.12.8.2 |
| 20.15 | 20.15.6.1 |
| 20.18 | 20.18.4.1 |
| 26.1 | 26.1.2.1 |
These are bounds taken from NVD, not necessarily the fixed releases to install. Check the Cisco security advisory for the fix on your branch, and confirm the status of end-of-support branches.
Detection
- SD-WAN Manager audit logs: administrative actions (template, policy or account changes) that match no planned work
- API access from source addresses outside your management networks
- Accounts or API tokens created recently
- Configurations pushed to routers without a matching change ticket — compare against your last known-good backup
Mitigation
- Apply Cisco's fixed release for your branch. The CISA deadline is October 3: treat it as an emergency.
- Take the management interface off the internet. SD-WAN Manager has no reason to be reachable outside management networks and the control plane.
- Restrict API access with access lists upstream of the appliance.
- Check the integrity of current templates and policies against a backup taken before publication.
- If you suspect compromise: rotate admin credentials and integration secrets, and follow the investigation guidance in Cisco's advisory.
Why Continuous Monitoring of Network Consoles Matters
An SD-WAN management console controls every site at once. When a 9.8 CVE lands in KEV on the day it's published, the response window is counted in days — and it assumes you know immediately which version runs where.
With cveo.tech, inventory your network consoles and devices with exact versions, and get alerted whenever a CISA KEV CVE affects them.