Cisco issues urgent patch for Catalyst SD-WAN zero-day

Cisco released urgent patches on Wednesday for CVE-2026-76504, a critical authentication-bypass in Catalyst SD-WAN Manager with a CVSS score of 9.8. The company’s Product Security Incident Response Team reported active exploitation beginning in September 2026. The flaw could let remote, unauthenticated attackers obtain administrative access to affected systems.

Cisco attributed the defect to improper handling of URI encoding in the API session-based authentication mechanism. Crafted HTTP requests can reach a restricted API endpoint and bypass authentication. Cisco warned that “an attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.”

All Catalyst SD-WAN Manager deployments are affected regardless of configuration, and Cisco reported there are no workarounds. Fixed releases include Catalyst SD-WAN versions 26.2.1, 26.1.2.1, 20.18.4.1, 20.15.6.1, 20.12.8.2 and 20.9.10.1. Cisco-managed SD-WAN environments have already been updated.

Cisco published indicators of compromise to help teams hunt for evidence of intrusion and issued general hardening recommendations. The U.S. Cybersecurity and Infrastructure Security Agency added the defect to its Known Exploited Vulnerabilities catalog and directed federal agencies to apply patches within three days. Neither Cisco nor CISA released technical details about the exploit methods observed.

Jake Knott, head of threat intelligence at WatchTowr, noted that the platform’s role as a central management interface makes it a frequent target and that eight Cisco SD-WAN CVEs have been added to CISA’s KEV list so far in 2026. He recommended immediate upgrades and advised organizations to search logs for POST requests to URL-encoded variants of ‘/j_security_check’ and to examine instances for signs of compromise.

Security teams are advised to install the fixed releases, apply Cisco’s mitigation guidance where applicable and use the published IoCs to scan for intrusions. Because the flaw allows unauthenticated administrative access, organizations should assume high risk until systems are updated and any indications of compromise are investigated and remediated.