Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-76504: Cisco Catalyst SD-WAN Manager lets remote attacker gain admin access
CVE-2026-76504 · published 19 days ago · actively exploited
Summary
The SD-WAN Manager software can be tricked by a specially crafted web request, allowing someone on the network to log in without a password and act as an administrator. This could let an attacker change settings, view data, or disrupt services. Apply the latest Cisco update and verify that only trusted users can reach the manager interface.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| cisco | cisco catalyst sd-wan manager |
18.3.6 20.1.12 |
| cisco | catalyst sd-wan manager | All versions |
| cisco | catalyst_sd-wan_manager |
< 20.9.10.1 >= 20.12, < 20.12.8.2 >= 20.15, < 20.15.6.1 >= 20.18, < 20.18.4.1 >= 26.1, < 26.1.2.1 26.2 cpe:2.3:a:cisco:catalyst_sd-wan_manager:*:*:*:*:*:*:*:* |
Original advisory text
Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/ci... Mitigation Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-... US Government Resource
Internet-facing
3 days
and check for signs of compromise
Internal
3 days
and check for signs of compromise
- Known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
2%
chance of attack within 30 days
Type
CWE-177Improper Handling of URL Encoding (Hex Encoding)
Timeline
Published30 Sep 2026
Updated15 Oct 2026
First seen30 Sep 2026
Track software like this
Free during beta