What it is
CVE-2026-76504 is an unauthenticated vulnerability affecting Cisco Catalyst SD-WAN Manager. A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an...
Vulnerability report
Active exploitation observed
Confirmed confidence
In CISA KEV
CVE-2026-76504
Cisco Catalyst SD-WAN Manager
Cisco Catalyst SD-WAN Manager · 20.1.12
- Severity
- CVSS 9.8 · Critical
- Confidence
- Confirmed
- Exploit status
- Observed in sensors
- EPSS
- 1.8%
- First observed
- 02 Oct 2026
- Last observed
- 08 Oct 2026
Decision summary
What security teams need to know first
Direct answers before the deeper technical record.
Is it exploited?
Yes. Previdian sensors observed exploitation attempts with confirmed confidence. Listed in CISA KEV. Also confirmed by third-party sources.
Who is affected?
Cisco Catalyst SD-WAN Manager 20.1.12.
What should we do?
Patch immediately, validate internet-facing exposure, and monitor for matching requests.
Overview
Cisco Catalyst SD-WAN Manager
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint.
An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.
Vendor
Product
Affected
Status
Cisco
Affected
Cisco Catalyst SD-WAN Manager
20.1.12
19.2.1
18.4.4
18.4.5
20.1.1.1
20.1.1
19.3.0
19.2.2
19.2.099
18.3.6
18.3.7
19.2.0
18.3.8
19.0.0
19.1.0
18.4.302
18.4.303
19.2.097
19.2.098
17.2.10
18.3.6.1
19.0.1a
18.2.0
18.4.3
18.4.1
17.2.8
18.3.3.1
18.4.0
18.3.1
17.2.6
17.2.9
18.3.4
17.2.5
18.3.1.1
18.3.5
18.4.0.1
18.3.3
17.2.7
17.2.4
18.3.0
19.2.3
18.4.501_ES
20.3.1
20.1.2
19.2.929
19.2.31
20.3.2
19.2.32
20.3.2_925
20.3.2.1
20.3.2.1_927
18.4.6
20.1.2_937
20.4.1
20.3.2_928
20.3.2_929
20.4.1.0.1
20.3.2.1_930
19.2.4
20.5.0.1.1
20.4.1.1
20.3.3
19.2.4.0.1
20.3.2_937
20.3.3.1
20.5.1
20.1.3
20.3.3.0.4
20.3.3.1.2
20.3.3.1.1
20.4.1.2
20.3.3.0.2
20.4.1.1.5
20.4.1.0.01
20.4.1.0.02
20.3.3.1.7
20.3.3.1.5
20.5.1.0.1
20.3.3.1.10
20.3.3.0.8
20.4.2
20.4.2.0.1
20.3.4
20.3.3.0.14
19.2.4.0.8
19.2.4.0.9
20.3.4.0.1
20.3.2.0.5
20.6.1
20.5.1.0.2
20.3.3.0.17
20.6.1.1
20.6.0.18.3
20.3.2.0.6
20.6.0.18.4
20.4.2.0.2
20.3.3.0.16
20.3.4.0.5
20.6.1.0.1
20.3.4.0.6
20.6.2
20.7.1EFT2
20.3.4.0.9
20.3.4.0.11
20.4.2.0.4
20.3.3.0.18
20.7.1
20.6.2.1
20.3.4.1
20.5.1.1
20.4.2.1
20.4.2.1.1
20.3.4.1.1
20.3.813
20.3.4.0.19
20.4.2.2.1
20.5.1.2
20.3.4.2
20.3.814
20.4.2.2
20.6.2.2
20.3.4.2.1
20.7.1.1
20.3.4.1.2
20.6.2.2.2
20.3.4.0.20
20.6.2.2.3
20.4.2.2.2
20.3.5
20.6.2.0.4
20.4.2.2.3
20.3.4.0.24
20.6.2.2.7
20.6.3
20.3.4.2.2
20.4.2.2.4
20.7.1.0.2
20.8.1
20.3.5.0.8
20.3.5.0.9
20.4.2.2.8
20.3.5.0.7
20.6.3.0.7
20.6.3.0.5
20.6.3.0.10
20.6.3.0.2
20.7.2
20.9.1EFT2
20.6.3.0.11
20.6.3.1
20.6.3.0.14
20.6.4
20.9.1
20.6.3.0.19
20.6.3.0.18
20.3.6
20.9.1.1
20.6.3.0.23
20.6.4.0.4
20.6.3.0.25
20.6.5
20.6.3.0.27
20.9.2
20.9.2.1
20.6.3.0.29
20.6.3.0.31
20.6.3.0.32
20.10.1
20.6.3.0.33
20.9.2.0.01
20.9.1_LI_Images
20.10.1_LI_Images
20.9.2_LI_Images
20.3.7
20.9.3
20.6.5.1
20.11.1
20.11.1_LI_Images
20.9.3_LI_ Images
20.6.3.1.1
20.9.3.0.2
20.6.5.1.2
20.9.3.0.3
20.4.2.3
20.6.3.2
20.6.4.1
20.6.3.0.38
20.6.3.0.39
20.3.5.1
20.3.4.3
20.9.3.1
20.3.3.2
20.6.5.2
20.3.7.1
20.10.1.1
20.6.5.2.1
20.3.4.0.25
20.6.2.2.4
20.6.1.2
20.11.1.1
20.9.3.0.5
20.3.4.0.26
20.6.5.1.3
20.6.3.0.40
20.1.3.1
20.9.2.2
20.6.5.2.3
20.6.5.1.4
20.6.5.3
20.6.3.0.41
20.9.3.0.7
20.6.5.1.5
20.9.3.0.4
20.6.4.0.19
20.6.5.1.6
20.9.3.0.8
20.6.3.3
20.3.7.2
20.6.5.4
20.6.5.1.7
20.9.3.0.12
20.6.4.2
20.6.5.5
20.9.3.2
20.11.1.2
20.6.3.4
20.10.1.2
20.6.5.1.9
20.9.3.0.16
20.6.3.0.45
20.6.5.1.10
20.9.3.0.17
20.6.5.2.4
20.6.4.0.21
20.9.3.0.18
20.6.3.0.46
20.6.3.0.47
20.9.2.3
20.9.3.2_LI_Images
20.9.3.0.21
20.9.3.0.20
20.9.4_LI_Images
20.9.4
20.6.5.1.11
20.12.1
20.12.1_LI_Images
20.6.5.1.13
20.9.3.0.23
20.6.5.2.8
20.9.4.1
20.9.4.1_LI_Images
20.9.3.0.25
20.9.3.0.24
20.6.5.1.14
20.3.8
20.6.6
20.9.3.0.26
20.6.3.0.51
20.9.3.0.29
20.12.2
20.12.2_LI_Images
20.6.6.0.1
20.13.1_LI_Images
20.9.4.0.4
20.13.1
20.9.4.1.1
20.9.5
20.9.5_LI_Images
20.12.3_LI_Images
20.12.3
20.9.4.1.3
20.6.7
20.9.5.1
20.9.5.1_LI_Images
20.9.4.1.6
20.14.1
20.14.1_LI_Images
20.9.5.2
20.9.5.2.1
20.9.5.2_LI_Images
20.12.3.1
20.12.4
20.15.1_LI_Images
20.15.1
20.9.5.1.4
20.9.5.2.7
20.9.5.2.13
20.9.6
20.9.6_LI_Images
20.9.5.2.14
20.6.8
20.12.4.0.03
20.16.1
20.16.1_LI_Images
20.12.4_LI_Images
20.9.5.2.16
20.12.4.0.4
20.12.401
20.9.5.3
20.9.5.3_LI_Images
20.12.4.1_LI_Images
20.12.4.1
20.9.5.2.21
20.9.6.0.3
20.12.4.0.6
20.15.2_LI_Images
20.15.2
20.12.4_Monthly_ES5
20.12.5
20.12.5_LI_Images
20.9.7_LI _Images
20.9.7
20.15.3
20.15.3_ LI _Images
20.12.501
20.12.5.1_LI_Images
20.12.5.1
20.12.5.2_LI_Images
20.12.5.2
20.15.3.1
20.15.4_LI_Images
20.15.4
20.9.7.1_LI _Images
20.9.7.1
20.18.1
20.18.1_LI_Images
20.12.6_LI_Images
20.12.6
20.12.5.1.01
26.0.1
20.9.8
20.9.8_LI_Images
20.18.2
20.15.4.1_LI_Images
20.15.4.1
20.18.2_LI_Images
26.1.1
26.1.1_LI_Images
20.18.2.1_LI_Images
20.18.2.1
20.15.4.2_LI_Images
20.15.4.2
20.12.6.1
20.12.6.1_LI_Images
20.12.5.3
20.12.5.3_LI_Images
20.9.8.2_LI_Images
20.9.8.2
20.18.3
20.18.3_LI_Images
20.15.5
20.15.5_LI_Images
20.12.7
20.12.7_LI_Images
20.9.9
20.9.9_LI_Images
20.18.2.2
20.18.2.2_LI_Images
20.12.5.4
20.12.5.4_LI_ Images
20.12.7.1_LI_Images
20.12.6.2_LI_Images
20.12.7.1
20.15.5.1
20.15.4.3
20.15.4.3_LI_Images
20.15.5.1_LI_Images
20.12.6.2
20.15.5.2
20.15.5.2_LI_Images
26.1.1.1_LI_Images
20.15.4.4
20.15.4.4_LI_Images
26.1.1.1
20.9.9.1_LI_Images
20.9.9.1
20.18.3.1_LI_Images
20.18.3.1
26.1.1.2
26.1.1.2_LI_Images
20.15.4.5
20.15.4.5_LI_Images
20.15.5.3
20.15.5.3_LI_Images
20.12.7.2_LI_Images
20.12.7.2
20.9.9.2
20.9.9.2_LI_Images
20.15.6
20.15.6_LI_Images
20.18.4_LI_Imagess
20.18.4
20.12.8
20.12.8_LI_Images
20.18.4_LI_Images
20.12.8.1
20.12.8.1_LI_Images
20.9.10_LI_Images
20.9.10
26.1.2_LI_Images
26.1.2
20.15.6.0.5_PSIRTAUG
20.18.4.0.5_PSIRTAUG
20.12.8.1.1
20.9.10.0.01
26.1.2.0.02
26.2.1_LI_Images
20.18.4.1.01
26.1.2.1_LI_Images
20.15.6.1_LI_Images
20.18.4.1_LI_Images
20.9.10.1.01
20.15.6.1.01
26.1.2.1.01
20.12.8.2.01
Affected
- Published
- 30 Sep 2026
- Exploitation Reported
- 30 Sep 2026
- Attack vector
- Remote
- Complexity
- Low
- Privileges
- None
- User interaction
- None
Tags
edge
cisa
CVE References
- CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2026-76504
- cisco-sa-sdwan-webauth-xr8beuuU sec.cloudapps.cisco.com · CVE Record https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurity...
Exploitation evidence
Why Previdian marks this CVE as exploited
Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.
Exploited in the wild
Cisco PSIRT CSAF
A trusted third party reported exploitation.
Active exploitation observed
Previdian sensor
Previdian first observed exploitation attempts targeting this vulnerability in our honeypot sensors.
Proof of concept available
GitHub
Public scanner or PoC coverage increases practical exploitability.
Known exploited vulnerability sources
Per-source evidence links for KEV attestations are available through the Previdian Pro API.
Learn about Pro API access| Source | Added |
|---|---|
| Cisco PSIRT CSAF First | 2026-09-30 13:49 UTC |
| Rapid7 | 2026-09-30 15:21 UTC |
| The Hacker News | 2026-09-30 15:30 UTC |
| CISA | 2026-09-30 17:31 UTC |
| Qualys ThreatPROTECT | 2026-10-01 08:20 UTC |
| Security Affairs | 2026-10-01 10:21 UTC |
| SOCRadar | 2026-10-01 13:20 UTC |
| Previdian Sensors | 2026-10-02 12:10 UTC |
| The Shadowserver | 2026-10-09 00:00 UTC |
Operational indicators for this CVE are listed under Detection.
Sensor telemetry
First-party evidence of exploitation activity
Previdian sensors recorded exploitation attempts targeting this vulnerability. The cards and chart show volume, unique attackers, and daily activity.
44
Attempts observed
7
Unique attacker IPs
5
Attacker countries
DE · GB · TH · TW · US
4
Sensors observed
CVE-2026-76504 exploitation attempts over the last 10 days
Daily events observed by Previdian sensors
Updated 10 Oct 2026
1 Oct
3 Oct
5 Oct
7 Oct
10 Oct
First observed 02 Oct 2026 · Last observed 08 Oct 2026
Pro adds sensor region and window summaries. Enterprise adds raw IPs, paths, User-Agents, and payloads.
Detection
Operational artifacts and observed signals
Make the evidence actionable in scanner, SOC, and edge-control workflows.
Observed signals
- Request targets
- User-Agents
- Callback hosts
- 19
- 7
- 0
Request targets and User-Agents available in Pro. Callback host details available in Enterprise.
Scanner coverage
No scanner integrations recorded yet.
Virtual patch status
No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.
Learn about virtual patches →Attacker IP Indicators
Attacker IP indicators observed · available in Pro and Enterprise.
Sensor-derived attacker IP indicators are available to Pro and Enterprise accounts under Detection and through the Pro API.
Learn about Pro API accessRisk and context
Severity, weaknesses, and research context
CVSS v3.1
9.8
Critical
Potential damage if exploited. Separate from whether attackers are using it.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
1.8%
Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.
Recent mention · The Hacker News
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
Ravie LakshmananOct 02, 2026Vulnerability / Enterprise Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities (KEV) catalog, following reports...
Read full advisoryAll Mentions
Recent mention · The Hacker News
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File WritesThe Hacker News · 02 Oct 2026
Ravie LakshmananOct 02, 2026Vulnerability / Enterprise Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation. The vulnerability, tracked as CVE-2026-104286 (CVSS score: 9.8), allows unauthenticated attackers to write arbitrary files on the underlying system. "An improper limitation of a pathname to a restricted directory ('path traversal') [CWE-22] and improper neutralization of NULL byte or NULL...
Recent mention · SOCRadar
CVE-2026-76504: Cisco SD-WAN Flaw ExploitedSOCRadar · 01 Oct 2026
CVE-2026-76504: Cisco SD-WAN Flaw Exploited Cisco has disclosed CVE-2026-76504 , a critical authentication bypass vulnerability in Catalyst SD-WAN Manager, formerly known as vManage. The flaw allows an unauthenticated re
Recent mention · The Hacker News
CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEVThe Hacker News · 01 Oct 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical authentication bypass flaw impacting Cisco Catalyst SD-WAN Manager to its Known Exploited Vulnerabilities (KEV), following reports of active exploitation. The vulnerability, tracked as CVE-2026-76504 (CVSS score: 9.8), could allow an unauthenticated, remote attacker to access an affected system with
Recent mention · Security Affairs
U.S. CISA adds Cisco Catalyst SD-WAN Manager flaw to its Known Exploited Vulnerabilities catalogSecurity Affairs · 01 Oct 2026
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Cisco Catalyst SD-WAN Manager flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Cisco Catalyst SD-WAN Manager flaw, tracked as CVE-2026-76504 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability resides in Cisco Catalyst SD-WAN Manager’s […]
Recent mention · Qualys ThreatPROTECT
Cisco Catalyst SD-WAN Manager Authentication Bypass Vulnerability Exploited in Attacks (CVE-2026-76504)Qualys ThreatPROTECT · 01 Oct 2026
Cisco released a security advisory addressing a critical vulnerability affecting the Cisco Catalyst SD-WAN Manager. Tracked as CVE-2026-76504, successful exploitation of the vulnerability could allow an unauthenticated, remote attacker to access an affected system with admin privileges. Cisco mentioned in their advisory that they are aware of the vulnerability being exploited. CISA also acknowledged the … Continue reading "Cisco Catalyst SD-WAN Manager Authentication Bypass Vulnerability Exploited in Attacks (CVE-2026-76504)"
Recent mention · Rapid7
Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)Rapid7 · 30 Sep 2026
OverviewOn September 30, 2026, Cisco published a security advisory for CVE-2026-76504, a critical API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager. The vulnerability has a CVSSv3.1 score of 9.8 and results from improper handling of URL encoding (CWE-177). An unauthenticated, remote attacker can send a crafted HTTP request that bypasses an authentication rule for a specific API endpoint, gaining access to the API with the privileges of the admin user.According to Cisco, CVE-2026-76504 is being actively exploited in the wild; Cisco PSIRT became aware of the...
Recent mention · Cisco Security Advisory
Cisco Catalyst SD-WAN Manager API Authentication Bypass VulnerabilityCisco Security Advisory · 30 Sep 2026
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass...
Recent mention · The Hacker News
Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN ManagerThe Hacker News · 30 Sep 2026
Swati KhandelwalSep 30, 2026Vulnerability / Network Security Attackers are exploiting a critical flaw in Cisco Catalyst SD-WAN Manager, the system companies use to manage their Cisco SD-WAN networks, Cisco said in an advisory on September 30. The flaw, CVE-2026-76504, could allow a remote attacker with no login access to use the Manager's API as the admin user. Fixed releases are available, and there is no workaround. CVE-2026-76504 carries a CVSS score of 9.8 out of 10. It sits in the part of the Manager's API that handles login sessions. The Manager mishandles URI encoding in an HTTP...
Potential Proof of Concepts
These PoCs are unverified and could contain malware. Use at your own risk.
ShadowForge-Cyber/CVE-2026-76504-Proof-of-concept
github · Created 2026-09-30 19:40:15 UTC · 0 stars · AI assessment 85%
EUVD-2026-89950 Improper Handling of URL Encoding (Hex Encoding) (CWE-177)
Timeline
From disclosure to observed exploitation
-
00:00 UTC
KEV confirmed by The Shadowserver
Exploitation attested by an external source
-
12:09 UTC
Indicators of compromise added (7)
Indicators of compromise recorded
-
12:09 UTC
Observed by Previdian sensors
Evidence-backed exploitation signal
-
13:20 UTC
KEV confirmed by SOCRadar
Exploitation attested by an external source
-
10:21 UTC
KEV confirmed by Security Affairs
Exploitation attested by an external source
-
08:20 UTC
KEV confirmed by Qualys ThreatPROTECT
Exploitation attested by an external source
-
19:40 UTC
Public PoC available
Public proof-of-concept code published
-
17:31 UTC
Added to CISA KEV
Listed in the CISA Known Exploited Vulnerabilities catalog
-
15:30 UTC
KEV confirmed by The Hacker News
Exploitation attested by an external source
-
15:21 UTC
KEV confirmed by Rapid7
Exploitation attested by an external source
-
13:49 UTC
Added to Previdian KEV Feed
High-confidence, third-party attested exploitation
-
13:20 UTC
Added to the Previdian watchlist
Pro and Enterprise Watch users had 4 hours of early warning before CISA KEV. Also 1 hour before Previdian confirmed it as a KEV.
-
13:04 UTC
CVE published
Vulnerability disclosed publicly
-
12:02 UTC
CVE ID reserved
Identifier reserved by the CNA
Pro API
Automate this intelligence
Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.
- Evidence confidence and provenance
- First-party sensor telemetry
- PoC and scanner references
- Affected versions and enrichment
- Automation-ready JSON delivery
GET /api/v2/pro/kevs/CVE-2026-76504
Free JSON includes basic KEV fields{
"cve_id": "CVE-2026-76504",
"confidence": "Confirmed",
"cvss_score": 9.8,
"cvss_estimated": false,
"epss_score": 0.01819,
"exploit_status": {
"exploited_in_the_wild": true,
"active_exploitation_observed": true
},
"sensor_telemetry": { "attempts": 44, "sensors": 4 }
}