Cisco Patches Critical Catalyst SD-WAN Zero-Day Under Active Exploitation

Cisco has rolled out urgent patches for a critical authentication bypass vulnerability in its Catalyst SD-WAN Manager that has been actively exploited by attackers since September 2026. The flaw, tracked as CVE-2026-76504 with a CVSS score of 9.8, could allow remote, unauthenticated attackers to gain administrative access to vulnerable appliances.

The vulnerability resides in the API session-based authentication mechanism, specifically an improper handling of URI encoding in an HTTP request. This oversight enables crafted HTTP requests to bypass authentication and reach restricted API endpoints, granting the attacker administrative privileges.

Active Exploitation Confirmed, Patches Issued

Cisco became aware of active exploitation of CVE-2026-76504 in September 2026 and strongly recommends that customers upgrade their systems immediately. All Catalyst SD-WAN Manager deployments are affected, regardless of their configuration, and no workarounds are available.

The company has resolved the issue in Catalyst SD-WAN versions 26.2.1, 26.1.2.1, 20.18.4.1, 20.15.6.1, 20.12.8.2, and 20.9.10.1. Cisco has also confirmed that its own managed SD-WAN deployments have been patched.

In response to the confirmed in-the-wild exploitation, Cisco has released Indicators of Compromise (IoCs) to assist security teams in hunting for potential attack attempts. It has also published general recommendations for hardening at-risk systems.

CISA Directs Federal Agencies to Patch

On Wednesday, the US Cybersecurity and Infrastructure Security Agency (CISA) added the security defect to its Known Exploited Vulnerabilities (KEV) catalogue. CISA mandated that federal agencies patch the flaw within three days, underscoring the severity and confirmed risk posed by the vulnerability.

Neither Cisco nor CISA has publicly shared specific details regarding the nature or scope of the in-the-wild exploitation campaigns. However, cybersecurity experts highlight the pattern of attackers targeting SD-WAN platforms.

Jake Knott, head of threat intelligence at WatchTowr, noted that Cisco SD-WAN appears frequently on the CISA KEV list, indicating its value as an attractive target for threat actors. He advised organisations running Catalyst SD-WAN Manager to upgrade to a fixed release without delay and to actively hunt for POST requests to URL-encoded variants of ‘/j_security_check’ as a sign of potential exploitation.