# CVE-2026-76504: Cisco Catalyst SD-WAN Manager API authentication bypass

Source: https://junglewise.ai/threats/cve-2026-76504-a-vulnerability-in-the-api-session-based-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-76504 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-09-30

Cisco Catalyst SD-WAN Manager is a centralized control platform for managing SD-WAN deployments across enterprise networks. An unauthenticated attacker can exploit improper URI encoding handling in the API to bypass authentication and gain admin-level access to the system, potentially compromising the entire SD-WAN infrastructure.

Technologies: [Cisco Catalyst SD-WAN Manager](https://junglewise.ai/threats/technologies/catalyst-sd-wan-manager). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-76504 exploited in the wild?** Yes. CVE-2026-76504 is known to be exploited in the wild, first recorded on 30 September 2026. Treat it as urgent.

**How severe is CVE-2026-76504?** Critical severity, with a CVSS score of 9.8, published 30 September 2026.

**Which products and versions are affected?** Cisco Catalyst SD-WAN Manager.

**Is there a fix for CVE-2026-76504?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76504 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-76504?** Check whether you run Cisco Catalyst SD-WAN Manager. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in API session-based authentication management due to improper handling of URI encoding in HTTP requests. An attacker can send a crafted HTTP request with encoded characters (e.g., %6a for 'j') to bypass authentication rules protecting specific API endpoints like j_security_check. A successful exploit grants unauthenticated remote access with administrative privileges.

## Affected products

- Cisco Catalyst SD-WAN Manager

## Timeline

- 2026-09-30: disclosed: Cisco Security Advisory published

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU)

## Related threats

- [Cisco Catalyst SD-WAN Manager information disclosure in web interface](https://junglewise.ai/threats/cve-2026-20294-cisco-catalyst-sd-wan-manager-information-disclosure-in-web)
- [Cisco Catalyst SD-WAN Manager arbitrary file write in web UI](https://junglewise.ai/threats/cve-2026-20262-cisco-catalyst-sd-wan-manager-arbitrary-file-write-in-web-ui)
- [Cisco Catalyst SD-WAN Manager privilege escalation in CLI](https://junglewise.ai/threats/cve-2026-20245-cisco-catalyst-sd-wan-manager-privilege-escalation-in-cli)
- [Cisco Catalyst SD-WAN Manager XXE in web UI](https://junglewise.ai/threats/cve-2026-20224-cisco-catalyst-sd-wan-manager-xxe-in-web-ui)
- [Cisco Catalyst SD-WAN Manager privilege escalation in web UI](https://junglewise.ai/threats/cve-2026-20210-cisco-catalyst-sd-wan-manager-privilege-escalation-in-web-ui)