Cisco has released security updates for a critical zero-day vulnerability, indexed as CVE-2026-76504, affecting its Catalyst SD-WAN Manager software. The flaw allows unauthenticated attackers to gain remote administrative access by bypassing API authentication rules through specially crafted HTTP requests.
The vulnerability stems from improper URI encoding handling, specifically involving the use of the %6a character sequence. Cisco confirmed that the issue was identified in September 2026 following reports of active exploitation. The company advises administrators to update to patched versions, which include 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1.
To detect potential compromises, Cisco recommends checking log files such as serviceproxy-access.log and vmanage-server.log for unauthorized entries related to j_security_check. Additionally, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to secure their systems by October 3, 2026.
This incident marks the fifth zero-day vulnerability discovered in Cisco SD-WAN products since the beginning of 2026. Experts emphasize that while applying the software patch is critical, administrators should also ensure that the SD-WAN management interface is not exposed to the public internet and is protected by firewalls.
