CVE-2026-76504: Cisco SD-WAN Manager — Admin Access via API Bypass (September 2026)

CVE-2026-76504 — Cisco Catalyst SD-WAN Manager

CVE-2026-76504 is a critical vulnerability in Cisco Catalyst SD-WAN Manager, allowing attackers to bypass API authentication and gain unauthorized admin-level access. Cisco and CISA confirm active exploitation since September 2026; immediate action is required to prevent network compromise.

Attack Vector

Attackers exploit an authentication flaw in the SD-WAN Manager's API, bypassing normal controls to obtain administrative privileges. Successful exploitation requires network access to the management interface. Indicators of compromise include anomalous entries in serviceproxy-access.log and vmanage-server.log, signaling unauthorized API interactions and potential privilege escalation.

Who Is at Risk

All organizations running Cisco Catalyst SD-WAN Manager are at risk, regardless of deployment size or region. Cisco has confirmed exploitation in the wild; any unpatched instance is vulnerable. Enterprises relying on SD-WAN for critical network segmentation and remote access are especially exposed.

Patch & Mitigate

• Patch: Apply the official Cisco security update for Catalyst SD-WAN Manager immediately. Refer to Cisco advisories for exact version details and patch deadlines.
• Workaround: No reliable workaround is available; patching is mandatory.
• Detect: Review serviceproxy-access.log and vmanage-server.log for unauthorized API calls or unexpected admin actions. Monitor for new admin accounts and unusual configuration changes.

MITRE ATT&CK

• T1078 — Valid Accounts: Attackers leverage bypassed authentication to obtain admin access.
• T1190 — Exploit Public-Facing Application: The vulnerability is exploited via exposed SD-WAN Manager APIs.

Source: https://www.helpnetsecurity.com/2026/10/01/new-cisco-sd-wan-zero-day-exploited-in-the-wild-cve-2026-76504/