Cisco Catalyst SD-WAN CVE-2026-76504 is a critical authentication bypass that Cisco says attackers were actively exploiting in September 2026. It affects Cisco Catalyst SD-WAN Manager regardless of system configuration.
Unauthenticated remote attackers may gain API access with administrator privileges. Cisco provides fixed releases and says upgrading is the only remediation; its Live Protect shield offers temporary partial protection.
Cisco Catalyst SD-WAN CVE-2026-76504 Fixed Releases
Cisco says the flaw affects Catalyst SD-WAN Manager regardless of configuration. Cloud-hosted release 20.15.605 is already addressed by Cisco, and no user action is required for that hosted release.
| Release line | First fixed release |
|---|---|
| Earlier than 20.9 | Migrate to a fixed release |
| 20.9 | 20.9.10.1 |
| 20.12 | 20.12.8.2 |
| 20.15 | 20.15.6.1 |
| 20.18 | 20.18.4.1 |
| 26.1 | 26.1.2.1 |
| 26.2 | 26.2.1 |
Teams should match every deployment to its exact release line before scheduling maintenance. Cisco validates only the affected and fixed release information documented in its advisory.
Why This Authentication Bypass Is Critical
Cisco attributes the flaw to improper handling of URI encoding in an HTTP request. That error can bypass an authentication rule intended to restrict API access.
A successful attack may provide API access as the administrator user. Cisco assigns a CVSS 3.1 score of 9.8 Critical and identifies the weakness as CWE-177.
The Cisco advisory does not provide a CVSS 4.0 score. Its published severity assessment uses CVSS 3.1.
Cisco PSIRT became aware of active exploitation in September 2026. The company found the vulnerability while resolving a Cisco Technical Assistance Center support case.
This issue is separate from the CVE-2026-20127 SD-WAN peering bypass. Our KeyDrift campaign analysis also concerns a different Cisco SD-WAN vulnerability.
What SD-WAN Owners Should Do Now
- Inventory every Cisco Catalyst SD-WAN Manager deployment and record its running release.
- Prioritize systems reachable from unsecured networks, especially internet-exposed management systems.
- Restrict on-premises access to known, trusted hosts while the upgrade is prepared.
- Upgrade to the first fixed release or a later supported release for the active branch.
- Confirm the running version after maintenance and preserve relevant records for investigation.
Cisco says access restrictions are mitigations, not remediation. Cloud-hosted environments already have the access mitigation, but only fixed software removes the vulnerability.
The Live Protect shield can provide temporary partial coverage during upgrade planning. Cisco warns that it can affect legitimate logins using URI encoding, so teams should evaluate operational impact.
Organizations tracking the broader campaign can consult our Cisco SD-WAN exploitation overview. Keep that history separate from evidence about CVE-2026-76504 in the current environment.
The Remediation Decision
Do not treat a firewall rule or the temporary shield as closure. Cisco explicitly says no workaround addresses CVE-2026-76504 and recommends scheduling upgrades as soon as possible.
The durable action is version-based: identify the release line, install the listed fixed release, and verify the running build. Systems with internet exposure should lead that queue.
Frequently Asked Questions
Is CVE-2026-76504 being exploited?
Yes. Cisco PSIRT says it became aware of active exploitation in September 2026.
Does Cisco provide a workaround for CVE-2026-76504?
No. Cisco provides access restrictions as mitigation and a temporary Live Protect shield, but says upgrading is the only remediation.
Which Cisco Catalyst SD-WAN Manager releases fix CVE-2026-76504?
Cisco lists 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1 as the first fixed releases for their branches.
