Affected Systems

Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage): all versions prior to 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1. All deployments affected regardless of configuration. Vulnerability in API session-based authentication management.

Exploitation Status

Actively exploited in the wild since September 2026. Cisco PSIRT confirmed active exploitation. CISA added CVE-2026-76504 to KEV catalog on September 30, 2026, with federal remediation deadline of October 3, 2026. Attackers using URI-encoded character %6a ("j") in crafted HTTP requests to bypass authentication.

Business Impact

Unauthenticated remote attackers can escalate to full admin privileges on SD-WAN Manager systems, which control up to 6,000 SD-WAN devices per instance. Improper URI encoding handling allows authentication bypass on API endpoints. This is the fifth actively exploited SD-WAN zero-day in 2026. Cisco SD-WAN products have been targeted by ransomware groups and state-sponsored actors. Immediate risk to network infrastructure visibility and control.

Urgency

🔴 Immediate

Recommended Actions

  • Upgrade Cisco Catalyst SD-WAN Manager immediately to fixed releases: 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, or 26.2.1 depending on current version
  • Review /var/log/nms/containers/service-proxy/serviceproxy-access.log and /var/log/nms/vmanage-server.log for j_security_check entries from unknown or unauthorized IP addresses
  • Search logs for HTTP requests containing URI-encoded character %6a as indicator of compromise
  • Collect admin-tech files and open Cisco TAC case if compromise is suspected or logs show suspicious activity
  • Restrict network access to SD-WAN Manager API endpoints at perimeter firewalls until patching is complete