CVE-2026-76504

9.8 CRITICAL 39% exploit odds Drop everything exploited in the wild Fix listed Auth & access Network gear

What it is

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.

At a glance

Exploitability: Can be exploited over the network without logging in. High risk of data exposure, data tampering, service disruption.
In the wild: CISA lists this as exploited in real attacks. Treat as urgent.
Fix: A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

2026-08-19 12:02 UTC ReservedThe CVE id was reserved by its CNA
2026-09-30 Exploited in the wildAdded to CISA's Known Exploited Vulnerabilities list
2026-09-30 13:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2026-10-03 Remediation deadlineCISA's due date for federal agencies to fix it
2026-10-03 00:16 UTC Last updatedMost recent change to the record