Cisco patches fifth SD-WAN Manager zero-day of the year amid active attacks

Cisco has released security updates for a critical zero-day in Catalyst SD-WAN Manager (CVE-2026-76504) that, according to the vendor, attackers are already exploiting to escalate to admin privileges.

Catalyst SD-WAN Manager — formerly SD-WAN vManage — is network management software that lets administrators monitor and manage up to 6,000 SD-WAN devices from a single dashboard. Cisco's PSIRT became aware of active exploitation in September 2026 and strongly urges customers to move to a fixed software release.

The flaw

The vulnerability lies in API session-based authentication management and affects all deployments regardless of system configuration. It stems from improper handling of URI encoding in an HTTP request, which lets the request bypass an authentication rule meant to restrict access to a specific API endpoint. An attacker only needs to send a crafted HTTP request to gain remote access with admin privileges, no authentication required.

Cisco did not detail the attacks themselves but published indicators of compromise. Notably, threat actors use the sequence %6a — the URI-encoded character "j" — in malicious requests. Admins are advised to inspect the serviceproxy-access.log file (under /var/log/nms/containers/service-proxy) and vmanage-server.log (under /var/log/nms/) for j_security_check entries from unknown or unauthorized IP addresses. Where compromise is suspected, Cisco suggests opening a case with its TAC after collecting admin-tech files.

Fifth of the year

CVE-2026-76504 is the fifth SD-WAN zero-day exploited in the wild since the start of 2026. In February, Cisco fixed an information-disclosure flaw (CVE-2026-20127) that had been abused since at least 2023. In May came a maximum-severity SD-WAN Controller auth bypass (CVE-2026-20182). In early June, two more zero-days (CVE-2026-20245 and CVE-2026-20262) that granted root privileges were patched.

According to CISA, 90 Cisco vulnerabilities have been flagged as exploited in the wild since November 2021 — four of them in Catalyst SD-WAN Manager, and seven abused by ransomware operations.

Source: Bleeping Computer