CVE-2026-76504
Received Received - Intake

Authentication Bypass in Cisco Catalyst SD-WAN Manager

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cisco Systems, Inc.

Description
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-76504
EUVD
EUVD-2026-89950

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cisco catalyst_sd-wan_manager *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-177 The product does not properly handle when all or part of an input has been URL encoded.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass flaw in Cisco Catalyst SD-WAN Manager's API session-based authentication management. It allows unauthenticated remote attackers to gain admin-level access by exploiting improper URI encoding in HTTP requests, which bypasses authentication rules for specific API endpoints.

Detection Guidance

Monitor logs for unusual entries such as requests to /%6a_security_check from unauthorized IP addresses or calls to reserved system accounts like viptela-reserved-. Check for unexpected admin-level API access attempts.

Impact Analysis

An attacker could exploit this to gain full admin access to the system, potentially allowing them to read, modify, or delete sensitive data, disrupt operations, or take control of the network. Systems exposed to the internet are at higher risk.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR or HIPAA. Organizations may face legal penalties, data breach notifications, and reputational damage if exploited.

Mitigation Strategies

Upgrade to the latest fixed software release immediately. Restrict internet access to the system and use firewalls to filter traffic. Monitor logs for suspicious activity and follow Cisco's hardening guidelines.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76504. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart