Affected Systems

Cisco Catalyst SD-WAN Manager, all configurations. Affected versions: all releases prior to 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1. Releases earlier than 20.9 require migration. Internet-exposed Manager instances at highest risk. Cisco SD-WAN Cloud (Cisco Managed) already patched in 20.15.605.

Exploitation Status

Active exploitation confirmed by Cisco Product Security Incident Response Team in September 2026. Vulnerability discovered during Technical Assistance Center support case. Number of affected customers, attacker identity, and attack timeline not disclosed.

Business Impact

Remote attackers with no credentials can access SD-WAN Manager API with full admin (netadmin role) privileges via crafted HTTP request exploiting URI encoding mishandling in session login handler. CVSS 9.8. Internet-exposed Managers face immediate compromise risk. Attackers gain full device control. No workaround available. Upgrading alone may not remove existing attacker access. This is the eighth exploited Cisco SD-WAN vulnerability added to CISA KEV in 2026.

Urgency

🔴 Immediate

Recommended Actions

  • Upgrade Cisco Catalyst SD-WAN Manager immediately to fixed releases: 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, or 26.2.1 depending on release train. Migrate systems on releases earlier than 20.9.
  • Before upgrading, run 'request admin-tech' on Manager and collect output for forensic review. Open Severity 3 case with Cisco TAC referencing CVE-2026-76504 for compromise assessment.
  • Search /var/log/nms/containers/service-proxy/serviceproxy-access.log and /var/log/nms/vmanage-server.log for j_security_check or URI-encoded variants (e.g., /%6a_security_check) from unknown IPs or viptela-reserved-* service accounts.
  • Immediately restrict SD-WAN Manager access from internet and untrusted networks. Place behind firewall, allow only known trusted hosts, and limit HTTPS (443), SSH (22), and NETCONF (830) access to jump hosts or management subnets.
  • Assume compromise if internet-exposed prior to patching. Perform full incident response including credential rotation, session invalidation, and configuration audit after upgrade.