Zero Radar
← feed
CriticalVulnerabilityCVE-2026-76504updated 25 Oct 2026, 17:35 UTC

Cisco Catalyst SD-WAN Manager: attackers can log in as admin without credentials

Attackers on the internet can send a specially crafted web request that skips the login check and gets full administrator access to the management system. Anyone who can reach that system can then control the network it manages.

Exploited (CISA KEV)Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?YesConfirmed by CISA KEV · 30 Sept 202
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerNo credentials or login needed
  2. 2Crafted HTTP requestHex-encoded URI bypasses auth rule
  3. 3SD-WAN Manager APIProtected endpoint accepts request
  4. 4Admin sessionAttacker gets admin privileges
  5. ResultAttacker controls the SD-WAN Manager

What happened

An improper handling of URI (hex) encoding in HTTP requests lets unauthenticated remote requests bypass the authentication rule protecting a specific API endpoint, granting admin-level access to Cisco Catalyst SD-WAN Manager.

Why it is dangerous: A successful attacker gets administrator control of the SD-WAN management platform, which can change network routing, policies and configurations across the organization. Organizations with internet-exposed SD-WAN Manager instances are at highest risk.

Are you affected?

You are affected if you run Cisco Catalyst SD-WAN Manager with its API reachable over the network, especially from the internet.

Cisco Catalyst SD-WAN Manager (specific affected versions not stated in the provided material).

What to do

  1. Check whether your SD-WAN Manager is reachable from the internet and restrict access immediately.
  2. Apply the mitigations or patches from Cisco's security advisory for this vulnerability.
  3. If no mitigation is available, follow CISA BOD 26-04 guidance or stop using the product until fixed.
  4. Review logs for suspicious API requests and follow CISA's forensics triage requirements if compromise is possible.

Timeline

  1. 30 Sept 2026, 00:00 UTC
    Publicly disclosed
  2. 30 Sept 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 17:35 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-76504 · GHSA-xqjc-v467-8fvf
CVSS
9.8 / 10
EPSS
39% chance of exploitation within 30 days
Disclosed
30 Sept 2026, 00:00 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Cisco Catalyst SD-WAN Manager: attackers can log in as admin without credentials · Zero Radar