CVE-2026-76504
CRITICAL · 9.8 KEV EPSS 38.9%KEV-listed, CISA active-exploitation confirmation, emergency patches, in-the-wild attacks documented.
What: Unauthenticated remote authentication bypass in Cisco Catalyst SD-WAN Manager API via improper URI encoding; CVSS 9.8 CRITICAL; admin access achievable without credentials.
Why it matters: KEV-listed as of 2026-09-30 with confirmed in-the-wild exploitation. CISA mandated federal patching by Oct 3. Cisco issued emergency fixes across release trains. SD-WAN managers are critical infrastructure chokepoints; admin compromise enables lateral movement and ransomware deployment.
Where it's seen: CISA KEV notice, Cisco advisories, urgent defender chatter across social platforms, threat advisories citing active zero-day attacks, IoCs circulating, PoC discussions referencing URI encoding bypass technique.
RISK: CRITICAL — Unauthenticated admin API access, active exploitation, KEV-listed, federal mandate.
Description
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High