Cisco's advisory landed on 30 September, and the sentence that matters is in Cisco's own text: its PSIRT became aware of exploitation in September. The Hacker News reports the flaw, CVE-2026-76504, sits in the API session-based authentication of Catalyst SD-WAN Manager and scores 9.8. If you run the controller, the patch window opened some time ago and nobody told you.
What the bug is
Per Rapid7's write-up, the root cause is improper handling of URI encoding (CWE-177). A request that percent-encodes characters in the path can slip past the authentication check and arrive with admin-level API access. Cybersecurity News names the j_security_check endpoint, with an encoded "j" as %6a, as the thing to look for in logs. It applies regardless of configuration, and Cisco lists no workaround.
Third in one year
Rapid7 counts this as the third critical authentication bypass in Cisco's SD-WAN control components in 2026, after CVE-2026-20127 and CVE-2026-20182. Three is a pattern, not bad luck. The Manager is the single place that can push policy to every branch router, so a login bypass there is closer to owning the network than to owning one server.
Fixed releases
20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1 carry the fix, and Cisco's advisory is cisco-sa-sdwan-webauth-xr8beuuU. Rapid7 advises an emergency upgrade outside the normal cycle. Cisco's interim advice for on-premises installs is to stop the Manager being reachable from the internet and allow only trusted hosts.
Checks to run today
- Find every Manager instance, including lab and disaster-recovery copies, and note which are internet-reachable.
- Search serviceproxy-access.log and vmanage-server.log for encoded j_security_check requests from addresses you do not recognise.
- Look for accounts with the "viptela-reserved-" prefix that nobody provisioned; Cybersecurity News lists these as an indicator.
- Upgrade to a fixed release, then audit admin users, API keys and pushed templates. A bypass that was live for weeks may have left something behind.
- Ask the harder question: why does the management plane have a public address at all?
If you want a second pair of eyes on exposure of your network management tooling, email sales@halfteck.com.