New Cisco SD-WAN zero-day exploited in-the-wild (CVE-2026-76504)
For the fifth time this year, Cisco revealed attackers have exploited a vulnerability (CVE-2026-76504) in its SD-WAN solution in zero-day attacks.
The vendor’s incident responders became aware of active exploitation of this vulnerability in September 2026, after getting pinged and resolving a Cisco Technical Assistance Center (TAC) support case.
Cisco has yet to share any details about the attacks, but it has provided indicators of compromise defenders should look for to check whether they have been targeted.
About CVE-2026-76504
CVE-2026-76504 is an API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager, the central management console for Cisco’s software-defined wide area network solution. Compromising it can give attackers control over the network.
“This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint,” Cisco explained.
“An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.”
CVE-2026-76504 affects the following releases of Cisco Catalyst SD-WAN Manager, regardless of system configuration: 26.2, 26.1, 20.18, 20.15, 20.12, 20.9, and releases earlier than 20.9.
What to do?
Security updates carrying a fix have been provided for releases 20.9 through 26.2, but those running any release earlier that 20.9.10.1 should migrate to one of the fixed versions, as there are no workarounds that address this vulnerability.
“As a mitigation for On-Prem deployment customer environments, [customers] should restrict access from unsecured networks, such as the internet, to the system,” Cisco advised. “If access to the system is required from the internet, restrict system access to only known, trusted hosts on ports and protocols that are included in the user guides.”
But before implementing the security update, they should check whether their internet-exposed systems have been probed by attackers, or at least collect logs and a snapshot of the device for threat hunting once they have updated.
Among the indicators of compromise (IoCs) outlined by the vendor are entires in the serviceproxy-access.log and vmanage-server.log files.
“In some instances, these indicators of compromise (IOCs) may occur during standard operations. Therefore, they must be assessed against normal network posture to identify and avoid false positives,” Cisco noted, and said that customers may open a case with its TAC to get the vendor’s help in the investigation.
The US Cybersecurity and Infrastructure Security Agency has added CVE-2026-76504 to its Known Exploited Vulnerabilities catalog and ordered US federal civilian agencies to address it by October 3, 2026 and perform a compromise assessment.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
