Cisco Catalyst SD-WAN Manager auth-bypass flaw is reportedly under active exploitation

HTTP requests that bypass API authentication rules

BleepingComputer reported that Cisco released security updates for CVE-2026-76504, a critical zero-day in Catalyst SD-WAN Manager, formerly called SD-WAN vManage. Cisco reportedly said the flaw stems from improper handling of URI encoding in an HTTP request, allowing authentication rules for a specific API endpoint to be bypassed. The report says all deployments are affected regardless of configuration and that attackers can gain remote administrative access without authentication.

No directly comparable before-and-after measure is provided. The newly reported finding concerns active exploitation and an authentication-bypass flaw in Catalyst SD-WAN Manager.

Cisco reportedly issued fixes for CVE-2026-76504 after becoming aware of active exploitation in September 2026; CISA also reportedly added the vulnerability to its Known Exploited Vulnerabilities Catalog.

Catalyst SD-WAN Manager is network-management software used to monitor and manage SD-WAN devices from one dashboard. The reported issue concerns an authentication control and is described as being actively exploited, rather than solely a newly disclosed flaw.