External risk intelligence

Cisco Catalyst SD-WAN Manager Authentication Bypass Vulnerability

CVE advisoryKnown Exploit

CVE-2026-76504

The affected product, Cisco Catalyst SD-WAN Manager, functions as a centralized management console and orchestration platform. Such appliances are commonly deployed as web-based administrative interfaces reachable via the network to facilitate management tasks, making them a frequent target for remote, network-accessible exploitation.

Cisco Catalyst Sd Wan Manager

before 20.9.10.120.12 to before 20.12.8.220.15 to before 20.15.6.120.18 to before 20.18.4.126.1 to before 26.1.2.126.2

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in Cisco Catalyst SD-WAN Manager, impacting its API session authentication. An unauthenticated remote attacker could exploit this by sending a specially crafted HTTP request to gain administrative privileges. This could allow unauthorized access to and control over the affected system.

API flaw allows unauthenticated admin access.
Critical to confirm if this system is in use.
Understand and manage potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerability by sending a specially crafted HTTP request to the Cisco Catalyst SD-WAN Manager's API. This request leverages improper handling of URI encoding to bypass authentication rules, allowing the attacker to gain administrative privileges on the affected system.

No authentication required.
Crafted HTTP request bypasses authentication.
Gain administrative privileges.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated remote attacker could gain administrative privileges on an affected Cisco Catalyst SD-WAN Manager system by sending a specially crafted HTTP request that bypasses authentication rules. This could impact system access and control.

System access and control at risk.
Bypassing authentication via crafted HTTP request.
Unauthorized administrative access to the system.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Cisco Catalyst SD-WAN Manager is a centralized management platform, suggesting that ownership likely resides with infrastructure or platform teams responsible for network operations and device management. The first practical step is to identify all instances of this technology, confirm their network exposure and business criticality, and then determine the accountable owner for remediation planning.

Platform or infrastructure teams own resolution.
Verify external accessibility and business impact.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Cisco Catalyst SD-WAN Manager?

It is a centralized management console and orchestration platform used by network operations teams. It serves as the primary administrative interface for configuring, monitoring, and controlling SD-WAN devices and network infrastructure across an organization.

How does CVE-2026-76504 work?

This vulnerability involves improper handling of URI encoding, classified as CWE-177. When the system incorrectly parses the encoding in an incoming HTTP request, it fails to apply security rules, allowing an attacker to bypass authentication and gain unauthorized admin access.

Do I need a valid login to trigger this bug?

No. The vulnerability allows an unauthenticated, remote attacker to bypass security checks entirely. Normal, authorized requests are not what trigger the bug; it specifically requires a crafted HTTP request designed to manipulate how the API processes URI encoding.

Is my instance at risk according to Halo Surface Signal?

Because Cisco Catalyst SD-WAN Manager is often deployed as a web-based management interface reachable over the network, it is a frequent target. Halo Surface Signal identifies these platforms as high-risk, especially if the interface is exposed externally.

When should I take action for this CVE?

Immediately. Since this flaw grants administrative privileges to anyone who can reach the API, the first step is to inventory your environment to locate all instances, confirm their network accessibility, and prioritize them for patching.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.