CVE-2026-76504
Attackers are using a URI-encoding bypass to enter Cisco Catalyst SD-WAN Manager as administrators.
Encoding one character prevents the API authentication rule from matching the endpoint path.
Affects
Cisco Catalyst SD-WAN Manager, the management and orchestration component for Cisco SD-WAN deployments.
What it enables
Unauthenticated API access with administrator privileges
An unauthenticated attacker reaches the Manager API.→↓The attacker sends a crafted HTTP request with an encoded character in the authentication endpoint path.→↓The authentication rule fails to match the encoded URI.→↓The API grants access with administrator privileges.
Why this matters
This is an actively exploited failure of the administrative boundary around an enterprise SD-WAN control plane.
Detail and 2 sources
Any unauthenticated caller who can reach the Manager API can attempt the bypass.
The crafted URI misses the authentication rule and receives administrator-level API access.
Cisco confirms active exploitation and has published fixed releases.
Evidence
Cisco PSIRT advisory confirms the authentication bypass, administrator access, affected releases, fixes, and active exploitation
Preconditions
- access:network:internet
- reachable from the public internet
- interaction:none
- no user action required
Patch reality
- Pre-fix images still accepted
- No
- Reaches end-of-life hardware
- No
Cisco does not publish the underlying patch diff; these conclusions rely on its current remediation and lifecycle documentation.