A Vulnerability in Cisco Catalyst SD-WAN Manager Could Allow for Authentication Bypass

A vulnerability has been discovered in Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) that could allow for authentication bypass. Cisco Catalyst SD-WAN Manager is the centralized dashboard used to monitor and manage SD-WAN fabric devices, in some deployments up to several thousand devices from a single console. An attacker could exploit this vulnerability by sending a specially crafted HTTP request with a URI-encoded character to the Manager's API, which could allow the request to skip an authentication rule intended to restrict access to a specific endpoint. Successful exploitation of this vulnerability could result in an unauthenticated, remote attacker gaining admin-level access to the affected system's API, and by extension the ability to view or modify the configuration of every SD-WAN device that Manager instance controls. This vulnerability affects the product regardless of device configuration; there is no feature toggle or configuration setting that removes the exposure.

(CVE-2026-76504) has been publicly disclosed and exploited in the wild. Attackers are gaining unauthenticated, admin-level API access by sending an HTTP request with a URI-encoded character (Cisco's indicators of compromise point to encoding the letter "j" within the j_security_check login-handler path), which causes the authentication rule guarding that endpoint to fail to match and allows the request through unauthenticated.

A vulnerability has been discovered in Cisco Catalyst SD-WAN Manager that could allow for authentication bypass. The vulnerability exists in the API's session-based authentication management, and is due to improper handling of URI encoding in HTTP requests. Details of the vulnerability are as follows:

Tactic: Initial Access (TA0001):

Technique: Exploit Public-Facing Application (T1190):

Successful exploitation of this vulnerability could allow for authentication bypass and administrative API access in the context of the Cisco Catalyst SD-WAN Manager instance. Depending on the privileges associated with the account, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Accounts that are configured to have fewer rights on the system could be less impacted than those that operate with administrative user rights. In this case, exploitation grants admin-level access directly, so the distinction is limited: an attacker exploiting this vulnerability obtains full administrative control over the SD-WAN Manager API regardless of any account-level restrictions on the system.

We recommend the following actions be taken:

Copyright©2026 Center for Internet Security®