Critical Cisco Catalyst SD-WAN Manager vulnerability is being actively exploited — CISA requires patching by October 3

On September 30, 2026, CISA added critical vulnerability CVE-2026-76504 in Cisco Catalyst SD-WAN Manager (vManage) to the Known Exploited Vulnerabilities (KEV) catalog. The vulnerability, with a CVSS score of 9.8, allows an unauthenticated remote attacker to gain access to the system’s API with administrator rights by sending a specially crafted HTTP request. According to Cisco, active exploitation was observed in September 2026. There are no workarounds — the only protective measure is to update to a fixed version. U.S. Federal Civilian Executive Branch (FCEB) agencies are required to apply the patch by October 3, 2026.

Technical details of the vulnerability

According to the Cisco advisory, the vulnerability is related to improper handling of URI encoding in HTTP requests to the Cisco Catalyst SD-WAN Manager API. The weakness is classified as CWE-177 (Improper Handling of URL Encoded Data). An attacker can bypass the authentication rule that restricts access to a specific resource by using URL-encoded variants of the /j_security_check path — for example, /%6a_security_check. Successful exploitation provides full access to the API with administrator privileges without needing to know any credentials.

The attack vector is network-based, the exploitation complexity is low, and no user interaction is required. The full CVSS 3.1 vector is: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The entry in the NVD confirms the critical severity level.

Affected versions and fixes

The vulnerability affects only the Cisco Catalyst SD-WAN Manager (vManage) component — controllers, validators, and edge routers do not need to be updated under this advisory, as Cisco notes in its remediation guide. The vulnerability is present regardless of the system configuration.

Fixed versions by release train:

• Earlier than 20.9 — migration to a supported branch is required
• 20.9 — fixed in 20.9.10.1
• 20.12 — fixed in 20.12.8.2
• 20.15 — fixed in 20.15.6.1
• 20.18 — fixed in 20.18.4.1
• 26.1 — fixed in 26.1.2.1
• 26.2 — fixed in 26.2.1

Active exploitation and lack of details

Cisco PSIRT reports that active exploitation of CVE-2026-76504 became known in September 2026. However, neither Cisco nor other available sources disclose which threat actor is behind the attacks, how many organizations have been compromised, the scale of the campaign, or when the first exploitation occurred. Of particular concern is that SD-WAN Manager systems exposed to the internet are at the highest risk of compromise.

It is worth noting the context: this is not the first critical vulnerability in Cisco products in recent weeks. Earlier we wrote about an authentication bypass in Cisco ISE with CVSS 10.0, as well as about a critical RCE in Nexus 9000. The SD-WAN platform, used by enterprises as a single management pane for large networks, remains an attractive target for attackers.

Detecting signs of compromise

Cisco recommends checking two log files for signs of exploitation, but warns that similar entries may also appear during normal system operation — they must be correlated with the organization’s typical network behavior:

• Proxy service log: /var/log/nms/containers/service-proxy/serviceproxy-access.log — look for POST requests to URL-encoded variants of j_security_check (for example, /%6a_security_check) from unknown or unauthorized IP addresses
• vManage log: /var/log/nms/vmanage-server.log — look for requests to j_security_check from unknown IP addresses, especially for accounts with names starting with viptela-reserved-

Response procedure

There are no workarounds for CVE-2026-76504. Cisco recommends the following sequence of actions:

1. Restrict access to SD-WAN Manager from untrusted networks, including the internet. If external access is required, allow connections only from known trusted hosts
2. Collect admin-tech files from all Catalyst SD-WAN Manager instances, including cluster and disaster recovery nodes, before updating, so diagnostic data is not lost
3. Update all Manager/vManage instances to a fixed version from the table above, verifying compatibility with controllers using the compatibility matrix
4. Open a case with Cisco TAC and provide the collected admin-tech files for scanning for indicators of compromise

The three-day window between the publication of the advisory (September 30) and the FCEB deadline (October 3), combined with the lack of workarounds and confirmed active exploitation, makes this vulnerability a top-priority issue. Organizations using Cisco Catalyst SD-WAN Manager must immediately check their software version, collect diagnostics, and schedule an update — postponing the patch when a CVSS 9.8 vulnerability with a network attack vector and no authentication requirement is being actively exploited is unacceptable.