Cisco Catalyst SD-WAN Manager Zero-Day Actively Exploited

THREAT INTELLIGENCE

Peer Review

4.8

Proven Trust

Dark blue circle with two overlapping checkmarks, one green and one light blue.

ISO 27001 text with a globe outline symbol on a black background.

2025 winner badge for Cyber Security Excellence Awards with gold and black design.

Critical

CVE-2026-76504

Cisco

September 30, 2026

Executive Summary

A critical zero-day authentication bypass is being actively exploited, letting unauthenticated attackers reach the API as admin.

Key Details

Affected Platform

Cisco Catalyst SD-WAN

Attack Surface

Recommended Action

Apply vendor patch

Affected Environment

Cisco Catalyst SD-WAN Manager instances across all deployment configurations are affected, regardless of hardening or network topology in place.

Operational Impact

Successful exploitation grants full admin control of SD-WAN Manager, risking configuration changes, data exposure, and network disruption.

Technical Root Cause

Improper handling of URI encoding in HTTP requests lets crafted requests bypass an authentication rule restricting a specific API endpoint.

Recommended Mitigation

Upgrade to a fixed release immediately as no workarounds exist.
Restrict API exposure and enforce least privilege administrative access.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Explore Managed Detection and Response

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

Cisco Security Advisory cisco-sa-sdwan-webauth-xr8beuuU; CVE-2026-76504.