CISA KEV Flags Cisco Catalyst SD-WAN Manager CVE-2026-76504: Fixed Release Guide

CISA says it added the flaw because there is evidence of active exploitation. Cisco confirms that its Product Security Incident Response Team (PSIRT) learned of attacks in September 2026. If you run a customer-managed SD-WAN Manager, treat this as an emergency change, not something for next month's maintenance window.

What CISA announced​

CISA's September 30 alert contains one entry: CVE-2026-76504. The agency says vulnerabilities of this type are a frequent attack vector for malicious cyber actors and "pose significant risks to the federal enterprise."

The alert points to Binding Operational Directive (BOD) 26-04, "Prioritizing Security Updates Based on Risk." This directive sets vulnerability-management requirements for Federal Civilian Executive Branch (FCEB) agencies. According to CISA:

• It requires fast remediation of KEV-listed CVEs on publicly exposed assets where exploitation gives an attacker total control of the asset.
• It lets agencies defer action on lower-risk vulnerabilities.
• It sets basic expectations for when agencies must check whether attackers got in before the patch was applied.

BOD 26-04 binds only FCEB agencies. CISA encourages every other organization to adopt risk-based vulnerability management and to prioritize KEV entries.

Section summary: One KEV addition, one Cisco product, confirmed exploitation, and a directive that makes exposure and impact the main factors in patch urgency.

The flaw: one encoded character, admin access​

Cisco's advisory says the bug sits in the API session-based authentication management of Catalyst SD-WAN Manager. Some key facts:

• Root cause: The Manager mishandles URI encoding in HTTP requests. A crafted request can slip past an authentication rule meant to restrict access to a specific API endpoint.
• Result: A successful exploit gives the attacker API access as the admin user.
• Severity: Cisco rates it Critical with a CVSS 3.1 base score of 9.8 (vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack works over the network, has low complexity, needs no privileges or user interaction, and has high impact on confidentiality, integrity and availability.
• Weakness class: CWE-177, improper handling of URL encoding.
• Tracking: Cisco bug ID CSCww79570.
• Scope: Cisco says the Manager is affected regardless of system configuration. No product outside the advisory's Vulnerable Products section is known to be affected.
• Discovery: Cisco found the flaw while resolving a Technical Assistance Center (TAC) support case.

Here's how it works in plain terms. %6a is the URL-encoded form of the letter "j." The authentication rule appears to match the literal path j_security_check. If a request spells one character of that path in encoded form, the request can get past the rule. Cisco warns that %6a is only an example: any single encoded character in the request can be used to exploit the bug. Blocking one specific string at the edge won't fix it.

This affects the whole network, not one appliance. Cisco Catalyst SD-WAN Manager, formerly known as Viptela vManage, is the centralized management platform for Cisco Software-Defined Wide Area Network (SD-WAN) deployments. Security firm Field Effect notes that organizations exposing Cisco Catalyst SD-WAN Manager to the internet are the most exposed because the platform serves as the central management plane for SD-WAN environments. PrivacyNeedle reports that by default, the admin user associated with this access holds the netadmin role, which grants full operational control over the device.

Section summary: An unauthenticated attacker can send one crafted request and get admin API access on the system that controls your WAN.

Fixed releases​

Cisco says there is no workaround. The fix is an upgrade. First fixed releases by train:

If you use the cloud-hosted, Cisco-managed service, Cisco says it fixed the flaw in Cisco SD-WAN Cloud (Cisco Managed) Release 20.15.605, and you don't need to do anything. You can confirm your remediation status or software version through the Help function in the service GUI.

Recent patching doesn't protect you from this one. PrivacyNeedle notes that managers previously updated for earlier SD-WAN flaws in May or June of this year still require this new update. Rapid7 says CVE-2026-76504 targets a separate API authentication path, but the recurrence of authentication bypasses in internet-facing Catalyst SD-WAN control components reinforces the need for emergency remediation. Earlier WindowsForum coverage cited BleepingComputer's count that CVE-2026-76504 is the fifth SD-WAN zero-day vulnerability actively exploited in the wild since the start of the year.

For scanner users, Rapid7 says its Exposure Command, Vulnerability Management and Nexpose customers can assess exposure to CVE-2026-76504 with vulnerability checks expected to be available in the October 1 content release.

Upgrade and triage checklist​

Cisco's guidance breaks down into these steps:

1. Inventory every SD-WAN Manager instance. Include lab and disaster-recovery nodes. Note which release train each one runs.
2. Check exposure. Cisco says Manager systems exposed to the internet, including those with internet-exposed ports, are at risk of compromise.
3. Plan the upgrade properly. Cisco points administrators to its Catalyst SD-WAN Control Component Compatibility Matrix and Upgrade Matrix. It also says to confirm the target release supports your hardware, configuration and memory before upgrading.
4. Mitigate while you wait (on-premises only).
   • Block access from untrusted networks, including the internet.
   • If internet access is required, allow only known, trusted hosts, and only on the ports and protocols listed in Cisco's user guides.
   • Put SD-WAN control components behind a filtering device such as a firewall.
   • Cisco says this mitigation is already in place for cloud-hosted environments. It also cautions that mitigations can hurt functionality or performance, so test them first. Cisco considers them temporary, not a replacement for the upgrade.
5. Upgrade to the fixed release for your train. If you're on a release earlier than 20.9, migrate to a supported fixed release.

Section summary: Put a firewall in front of the Manager today, schedule the upgrade immediately, and don't assume earlier 2026 patches cover this flaw.

Checking whether you were already compromised​

The flaw was exploited before a patch existed, so a clean upgrade doesn't prove nobody got in first. Cisco suggests reviewing two logs for requests involving j_security_check from unknown or unauthorized IP addresses:

• /var/log/nms/containers/service-proxy/serviceproxy-access.log
• /var/log/nms/vmanage-server.log

Cisco's sample access-log entry shows a POST to /%6a_security_check returning HTTP 200. Its sample server-log entry shows the same path associated with a username beginning viptela-reserved-. Cisco documents the viptela-reserved accounts as system service accounts.

Keep three caveats in mind:

• Any single encoded character can be used, so search for encoded variants, not just %6a.
• Don't treat the sample's exact method or status code as the only possible pattern.
• Cisco says some of these indicators can appear during normal operations. Compare what you find against normal traffic before you declare an incident.

If you need help, Cisco says to open a Severity 3 TAC case with "CVE-2026-76504" in the title. Before you open the case, run request admin-tech on the Manager (vManage) and have the resulting file ready for TAC.

Cisco's longer-term hardening advice also applies:

• Send web logs to an external server and keep them long enough to support an investigation.
• Change the default administrator password.
• Create role-based user and operator accounts instead of sharing admin.
• Use CA-issued TLS certificates.

What BOD 26-04 means for this flaw​

BOD 26-04 was issued June 10, 2026. It supersedes and revokes BOD 19-02 and BOD 22-01, the directive that created the KEV Catalog. The biggest change is that remediation deadlines are no longer the same for every KEV entry. Urgency depends on four questions:

• Asset exposure: Is the asset publicly exposed?
• KEV status: Is the CVE in the catalog?
• Automation: Can an attacker automate every step of the exploit?
• Technical impact: Does the attacker get partial or total control?

For the highest-risk combinations, the directive's "& forensic triage" rule requires agencies to finish remediation or mitigation within three days and check the asset for compromise. Timelines are set per asset and change as conditions change. Taking a system off the internet changes its "publicly exposed" answer, which pushes the remaining deadline back. The clock starts when CISA adds the CVE to the KEV Catalog or when the agency finds the vulnerability on an asset, whichever comes first.

Federal agencies with an internet-reachable SD-WAN Manager should therefore work out their deadline asset by asset. With confirmed exploitation, no authentication required and admin-level access on the table, expect the strictest treatment. The catalog entry alone doesn't set one deadline for everyone.

My read, based on general industry experience: the BOD 26-04 model is useful outside government too. "Patch everything within X days" tends to leave important systems waiting behind low-risk ones. An internet-reachable management console with a KEV-listed admin bypass belongs at the top of the list. There is a tradeoff: a framework that rewards reducing exposure could tempt teams to firewall a system and then leave the patch undone. Cisco's own advice closes that gap by calling mitigations temporary and saying to upgrade.

Why Windows admins should care​

Your SD-WAN fabric carries the traffic between branch offices, Active Directory domain controllers, Microsoft 365, Azure workloads and endpoint management tools like Intune. An attacker with admin rights on the WAN controller can reroute, observe or disrupt all of it. If your Windows estate relies on SD-WAN connectivity, this flaw is your problem as well.

If you track KEV additions on WindowsForum, this one belongs next to recent Microsoft security patch cycles and edge-device advisories. It's the same pattern again: internet-facing management interfaces are a favorite target, and removing their exposure to the internet is the fastest, cheapest defense.

Bottom line​

• What happened: On September 30, 2026, CISA added CVE-2026-76504 (Cisco Catalyst SD-WAN Manager) to the KEV Catalog based on evidence of active exploitation.
• Risk: An unauthenticated remote attacker can get admin API access. CVSS 9.8. No workaround.
• Fix: Upgrade to 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 or 26.2.1. Releases older than 20.9 must migrate. Cisco-managed cloud tenants are covered by Release 20.15.605.
• Right now: Restrict Manager access to trusted hosts, review the two logs Cisco names, and open a TAC case if anything looks wrong.
• Federal agencies: Apply BOD 26-04 asset by asset. Everyone else should prioritize this CVE the same way.