Cisco SD-WAN Manager Flaw Gives Attackers Admin Access
An exploited URI-encoding bypass reaches the management API as admin. Check Cisco's service-proxy and server logs, restrict exposure, and install a fixed release.
Attackers are exploiting an authentication bypass in Cisco Catalyst SD-WAN Manager that gives an unauthenticated remote request access to its API with admin privileges. Cisco says its security response team learned of active exploitation in September. The manager is the place operators administer their SD-WAN deployment; admin access there puts a privileged management surface in an attacker’s hands.
CISA added CVE-2026-76504 to its Known Exploited Vulnerabilities catalog on September 30, with an October 3 action date for covered federal agencies and a call to evaluate each asset’s internet exposure. Cisco rates the flaw CVSS 9.8. On-premises operators should identify exposed managers now, review the access evidence, and schedule a fixed release.
Encoded requests evade the API rule
Cisco’s CVE record and advisory describe a failure in API session-based authentication management. The manager mishandles URI encoding in an HTTP request, so an encoded character in the path can bypass an authentication rule intended to protect a specific API endpoint. The result is API access with the admin user’s privileges without first authenticating. Cisco lists Catalyst SD-WAN Manager as affected regardless of system configuration.
A network filter restricts who can reach the manager while a fixed software release repairs the URI-encoding flaw. Cisco says, “There are no workarounds that address this vulnerability.” Its recommended temporary on-premises mitigation is to keep unsecured networks, including the internet, away from the control components and allow only known, trusted hosts through filtering devices on the necessary ports and protocols. Cisco says this network-access mitigation is already deployed for its cloud-hosted environments.
Service logs show suspect sign-ins
Cisco names two logs for a compromise review. Inspect /var/log/nms/containers/service-proxy/serviceproxy-access.log for requests involving j_security_check from unknown or unauthorized IP addresses. Then correlate their time and client with /var/log/nms/vmanage-server.log, especially calls involving users whose names begin viptela-reserved-. These reserved names belong to documented system service accounts, so assess the source and request against normal management traffic rather than treating the username alone as malicious. Cisco’s sample uses one encoded character, but the flaw permits any single character in the request to be encoded; a search for the sample encoding alone will miss other variants.
Preserve the relevant proxy and server logs before an upgrade or investigation changes the system. For a suspected compromise, Cisco asks customers to collect an admin-tech file with request admin-tech from vManage and open a Severity 3 Cisco TAC case with CVE-2026-76504 in its title. Compare suspicious entries with your permitted administrator source hosts and session history, and investigate unexpected admin activity on the manager. An upgrade fixes the vulnerable path; log triage addresses what may have happened while that path was open.
Fixed releases and exposed managers
Cisco’s first fixed releases for the affected software trains are 20.9.10.1 for 20.9, 20.12.8.2 for 20.12, 20.15.6.1 for 20.15, 20.18.4.1 for 20.18, 26.1.2.1 for 26.1, and 26.2.1 for 26.2. Migrate software earlier than 20.9 to a fixed release. Check the installed release on each on-premises manager against its matching train, then use Cisco’s compatibility and upgrade guidance when planning the change. Cisco says its managed cloud release 20.15.605 contains the fix and requires no customer action; the GUI Help function reports that environment’s remediation status or software version.
Prioritize any on-premises manager reachable from the internet. Remove untrusted reachability through firewall rules, retain access for explicitly authorized administrator hosts, and forward web logs to an external server so future review survives local log rotation. CISA’s KEV entry also calls for vendor-aligned mitigation and forensic triage under its risk-based update guidance. Verify the installed build after the maintenance window and test from an untrusted network that the manager’s management ports are blocked while an approved admin host retains its required access. That access test validates the filter; the build check validates the software change.
Check the manager and logs
Inventory Cisco Catalyst SD-WAN Manager instances, compare installed builds with Cisco’s fixed train list, and restrict on-premises management access to trusted hosts while upgrades roll out. Review the service-proxy and vManage server logs together for encoded sign-in requests and unexpected reserved-account activity. Cisco’s cloud-hosted mitigation and fixed managed release change the customer action there; on-premises managers need a verified fixed build. Keep the proxy and server evidence if activity looks suspicious, and send Cisco TAC the admin-tech file for a compromise assessment. A successful upgrade test returns the intended fixed build, and the network test blocks untrusted access without breaking approved administration.