This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule intended to restrict access to a specific API endpoint.
An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.
This vulnerability affects Cisco Catalyst SD-WAN Manager, regardless of system configuration.
CVE-2026-76504 is the case number for the vulnerability, which has a CVSS base score of 9.8.
Cisco Catalyst SD-WAN Manager systems exposed to the Internet and have ports exposed to the Internet are at risk of exposure to compromise. In some instances, these indicators of compromise (IOCs) may occur during standard operations. Therefore, users must assess them against normal network posture to identify and avoid false positives.
Finding Help
For help determining if Cisco Catalyst SD-WAN Manager is suffering from compromise, users can open a case with the Cisco Technical Assistance Center (TAC). Cisco TAC cases should open as a Severity 3 with the CVE-ID CVE-2026-76504 in the title. Before opening a new TAC case, customers should use the request admin-tech command from the Cisco Catalyst SD-WAN Manager (vManage) in the SD-WAN deployment so the admin-tech file can end up provided to the Cisco TAC for review.
There are no workarounds that address this vulnerability. However, as a mitigation for On-Prem deployment customer environments, they should restrict access from unsecured networks, such as the Internet, to the system. If access to the system is a requirement from the Internet, restrict system access to only known, trusted hosts on ports and protocols included in the user guides. Protect Cisco Catalyst SD-WAN Control Components behind a filtering device such as a firewall, and filter traffic to and from the system while allowing only known, trusted hosts to send traffic to the system.
For more information, see the Cisco Catalyst SD-WAN Hardening Guide.
For Cisco Catalyst SD-WAN Cloud Hosted environments, this mitigation is already deployed.
In the table below, the left column lists Cisco software releases. The right column indicates the fixed release. Customers should upgrade to an appropriate fixed software release as indicated in this section.
Chart above lists vulnerable versions on left and fixed versions on right.
Source: Cisco
Cisco has also addressed this vulnerability in Cisco SD-WAN Cloud (Cisco Managed) Release 20.15.605. No user action ends up needed. Users can determine the current remediation status or software version by using the Help function in the service GUI.
Click here for other Cisco security updates.