Cisco patches actively exploited SD-WAN Manager authentication bypass

Cisco has published an advisory for CVE-2026-76504, a critical authentication bypass in Cisco Catalyst SD-WAN Manager with a CVSSv3.1 score of 9.8. The flaw stems from improper handling of URL encoding and lets an unauthenticated remote attacker send a crafted HTTP request that skips an authentication rule on a specific API endpoint, reaching the API with admin privileges.

Cisco PSIRT learned in September 2026 that the vulnerability is being exploited in the wild. Systems with internet-exposed ports are at risk regardless of configuration, and there is no workaround, though fixed releases are available for branches from 20.9 through 26.2. Rapid7 recommends emergency upgrades and a compromise audit of internet-facing instances.