Reported by 19 outlets

Timeline

1. original reporting

   Cisco SD-WAN Manager CVE-2026-76504 — CVSS 9.8 auth bypass, active exploitation warned. Hex-encode one character in the URI (%6a instead of

   threataft.com · 13d ago · September 30th, 2026

   Cisco SD-WAN Manager CVE-2026-76504 — CVSS 9.8 auth bypass, active exploitation warned. Hex-encode one character in the URI (%6a instead of

   via Mastodon https://threataft.com/articles/cisco-catalyst-sd-wan-manager-cve-2026-76504-authentication-bypass

2. update from bleepingcomputer.com

   Cisco Catalyst SD-WAN Manager CVE-2026-20245 — 7th SD-WAN Zero-Day of 2026, Actively Exploited, No Patch Available

   bleepingcomputer.com · 131d ago · June 5th, 2026

   Cisco disclosed a high-severity privilege escalation vulnerability (CVSS 7.8) in its Catalyst SD-WAN Manager (formerly vManage) that is being actively exploited in the wild, with observed cases resulting in unauthorized configuration changes pushed to edge devices. Tracked as CVE-2026-20245, the flaw allows authenticated attackers with netadmin privileges to upload a crafted file and execute arbitrary commands as root. Attack chain context: The most likely path chains CVE-2026-20182 (CVSS 10.0) or CVE-2026-20127 (CVSS 10.0) — both authentication bypasses in the SD-WAN Controller exploited by threat actor UAT-8616 (Cisco Talos) since at least 2023 — to obtain the netadmin privileges required, then deploys CVE-2026-20245 to escalate to root. This marks the seventh SD-WAN vulnerability exploited in 2026 alone, indicating a sustained, methodical campaign against Cisco SD-WAN infrastructure. Indicators of compromise: Check /var/log/scripts.log for entries referencing /usr/bin/vconfd_script_upload_tenant_list.sh with suspicious -cli path arguments. Also audit SD-WAN Controller authentication logs for "Accepted publickey for vmanage-admin" from unknown IPs. Action: No patch or workaround exists. Organizations should (1) immediately patch CVE-2026-20182 and CVE-2026-20127 (patches available since mid-May) to break the attack chain, (2) audit and restrict netadmin accounts, (3) collect admin-tech files before any upgrades, and (4) treat internet-exposed SD-WAN Manager instances as priority incidents — patching alone won't remediate already-compromised systems.

3. update from bleepingcomputer.com

   Cisco SD-WAN Zero-Day (CVE-2026-20245) — Mandiant Reveals Root Access Achieved via Rogue Peer Connections, Active Since March

   bleepingcomputer.com · 111d ago · June 25th, 2026

   Mandiant has published detailed forensics on how an unknown threat actor exploited CVE-2026-20245, a high-severity command injection flaw in Cisco Catalyst SD-WAN Manager (vManage), Controller (vSmart), and Validator (vBond), to create rogue root accounts on targeted devices at a communications service provider. This is the seventh actively exploited SD-WAN zero-day this year — a staggering count that underscores what Mandiant calls the "living off the edge" paradigm. The intrusion began with unauthorized SD-WAN peering connections observed as early as March 2026, possibly exploiting previously disclosed authentication bypass CVEs (CVE-2026-20127, CVE-2026-20182). After gaining access via the vmanage-admin account, the attacker changed the default admin password, extracted edge device and controller configurations, exploited CVE-2026-20245 through a crafted CSV file (evil_tenant.csv), and created a rogue account named "troot" with root-level privileges. Mandiant noted extensive anti-forensic measures: configuration file backups before modification, deletion of the malicious CSV payload, log clearing, and a validation script to confirm traces were removed. Cisco has released patches. Hunting hypothesis: Monitor SD-WAN Manager devices for unauthorized peering connections, unexpected vmanage-admin password changes followed by restoration, and CSV upload operations to the tenant-upload CLI feature.

4. update from threataft.com

   Cisco Catalyst SD-WAN Manager CVE-2026-76504 (CVSS 9.8 Authentication Bypass)

   threataft.com · 13d ago · September 30th, 2026

   This writeup, dated 30 September 2026 with a feed pubDate of 09:00 GMT, is the earliest dated third-party coverage found, over four hours before the story's first capture. It details the mechanism as hex-encoding of any single URI character to bypass the authentication rule on a protected API endpoint, frames it as CWE-288, and walks the attack chain from finding an internet-exposed manager to admin-level API access. It also restates the log audit paths (serviceproxy-access.log and vmanage-server.log), the request admin-tech preservation step, and notes CISA KEV had not listed the CVE as of publication.

5. update from sec.cloudapps.cisco.com

   Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability (advisory cisco-sa-sdwan-webauth-xr8beuuU)

   sec.cloudapps.cisco.com · 13d ago · September 30th, 2026

   Cisco's advisory, first published 2026 September 30 at 13:00 GMT, scores CVE-2026-76504 at CVSS 9.8 (CWE-177) in the API session-based authentication management of Catalyst SD-WAN Manager, with bug ID CSCww79570 and no workarounds. It states the Cisco PSIRT became aware of active exploitation in September 2026 and that the vulnerability was found during the resolution of a TAC support case. The published IOCs include a sample successful request, POST /%6a_security_check returning HTTP 200, logged 2026-09-29 at 23:11 CDT, and fixed releases 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1.

6. update from sec.cloudapps.cisco.com

   🔴 EXPLOITED CVE-2026-76504: Cisco Catalyst SD-WAN Manager contains an authentication bypass (CVSS 9.8) letting an unauthenticated remote att

   sec.cloudapps.cisco.com · 13d ago · September 30th, 2026

   🔴 EXPLOITED CVE-2026-76504: Cisco Catalyst SD-WAN Manager contains an authentication bypass (CVSS 9.8) letting an unauthenticated remote att

   via Mastodon https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU

7. mentioned by dev.to

   Cisco has warned of active exploitation of CVE-2026-76504 — a CVSS 9.8 authentication bypass in Cisco... # security # networking # vulnerabi

   dev.to · 13d ago · September 30th, 2026

8. update from bleepingcomputer.com

   Cisco warns of new SD-WAN zero-day exploited in attacks

   bleepingcomputer.com · 13d ago · September 30th, 2026

   Formerly known as SD-WAN vManage, Catalyst SD-WAN Manager is network management software that lets admins monitor and manage up to 6,000 SD-WAN devices from a single dashboard. "An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system." While the company didn't share further details regarding attacks exploiting CVE-2026-76504, it shared indicators of compromise (IOCs) warning admins that threat actors are using %6a as the URI-encoded character "j" in malicious requests. It also advised security teams investigating potentially comprom

9. update from rapid7.com

   Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)

   rapid7.com · 13d ago · September 30th, 2026

   The vulnerability has a CVSSv3.1 score of 9.8 and results from improper handling of URL encoding ( CWE-177 ). The vulnerability affects the product regardless of system configuration, and Cisco has not provided a workaround, however vendor supplied updates are available. Rapid7 strongly recommends that organizations upgrade affected systems to a fixed release on an emergency basis, outside of normal patch cycles, and investigate internet-facing systems for signs of exploitation. Both were distinct issues in the vdaemon service and similar parts of its networking stack. CVE-2026-76504 targets a separate API authentication path, but the recurrence of authentication bypasses in internet-facing Cat

10. mentioned by securityonline.info

    Attackers exploit CVE-2026-76504, a 9.8 authentication bypass in Cisco SD-WAN Manager that grants admin API access. Patch now. # Cisco # SDW

    securityonline.info · 13d ago · September 30th, 2026

11. mentioned by www.rapid7.com

    (rapid7.com) Critical API Authentication Bypass in Cisco Catalyst SD-WAN Manager (CVE-2026-76504) Under Active Exploitation In brief - This

    www.rapid7.com · 13d ago · September 30th, 2026

12. mentioned by sec.cloudapps.cisco.com

    New advisory, new flaw. Cisco: CRITICAL CVE-2026-76504: Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability https:// sec.c

    sec.cloudapps.cisco.com · 13d ago · September 30th, 2026

13. mentioned by sec.cloudapps.cisco.com

    CVE-2026-76504 (CVSS 9.8): authentication bypass in Cisco Catalyst SD-WAN Manager via URI-encoding mishandling

    sec.cloudapps.cisco.com · 13d ago · September 30th, 2026

14. mentioned by sec.cloudapps.cisco.com

    https:// sec.cloudapps.cisco.com/securi ty/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU # ZeroDay # Cisco # CyberSec

    sec.cloudapps.cisco.com · 13d ago · September 30th, 2026

15. update from ifin.network

    Well would you look at that; it's Cisco 0-day o'clock again. https:// ifin.network/t/cve-2026-76504- cisco-sd-wan-auth-bypass-actively-explo

    ifin.network · 13d ago · September 30th, 2026

    Well would you look at that; it's Cisco 0-day o'clock again.

16. mentioned by go.dhs.gov

    We added Cisco Catalyst SD-WAN Manager hex encoding vulnerability CVE-2026-76504 to the KEV Catalog. Visit https:// go.dhs.gov/Z3Q & apply m

    go.dhs.gov · 13d ago · September 30th, 2026

17. mentioned by dev.to

    Cisco SD-WAN Manager Zero-Day CVE-2026-76504 Grants Unauthenticated Admin API Access # cybersecurity # infosec # security # software # codin

    dev.to · 13d ago · September 30th, 2026

18. mentioned by thehackernews.com

    🤖 CVE-2026-76504: critical authentication bypass in Cisco Catalyst SD-WAN Manager. An unauthenticated remote attacker can use the Manager's

    thehackernews.com · 13d ago · October 1st, 2026

19. update from theperimetersite.com

    CISA added CVE-2026-76504 to its Known Exploited Vulnerabilities list yesterday. If you're running Cisco Catalyst SD-WAN Managers, you've go

    theperimetersite.com · 12d ago · October 1st, 2026

    If you're running Cisco Catalyst SD-WAN Managers, you've go

    via Mastodon https://theperimetersite.com/report/317

20. mentioned by beyondmachines.net

    Cisco Patches Actively Exploited Zero-Day in Catalyst SD-WAN Manager Cisco released security updates for a zero-day vulnerability (CVE-2026-

    beyondmachines.net · 12d ago · October 1st, 2026

21. mentioned by thehackernews.com

    🤖 CVE-2026-76504 (CVSS 9.8): critical auth bypass in Cisco Catalyst SD-WAN Manager, actively exploited in the wild. CISA added it to the KEV

    thehackernews.com · 12d ago · October 1st, 2026

22. mentioned by sec.cloudapps.cisco.com

    Cisco says attackers are exploiting CVE-2026-76504 in Catalyst SD-WAN Manager. A crafted API request can give an unauthenticated attacker ad

    sec.cloudapps.cisco.com · 12d ago · October 1st, 2026

23. update from www.infosecurity-magazine.com

    Cisco has issued an urgent security update to address a newly uncovered zero-day vulnerability in Cisco Catalyst SD-WAN Manager which has al

    www.infosecurity-magazine.com · 12d ago · October 1st, 2026

    Cisco has issued an urgent security update to address a newly uncovered zero-day vulnerability in Cisco Catalyst SD-WAN Manager which has al

    via Mastodon https://www.infosecurity-magazine.com/news/critical-cisco-catalyst-sdwan/

24. mentioned by osintsights.com

    https:// osintsights.com/cisco-sd-wan-z ero-day-exploited-in-active-attacks?utm_source=mastodon&utm_medium=social # ZeroDay # Cisco # CyberS

    osintsights.com · 12d ago · October 1st, 2026

25. mentioned by securityaffairs.com

    U.S. CISA adds Cisco Catalyst SD-WAN Manager flaw to its Known Exploited Vulnerabilities catalog

    securityaffairs.com · 12d ago · October 1st, 2026

26. mentioned by horizon3.ai

    (horizon3.ai) Critical Authentication Bypass Vulnerability in Cisco Catalyst SD-WAN Manager (CVE-2026-76504) Exploited in the Wild In brief

    horizon3.ai · 12d ago · October 1st, 2026

27. mentioned by www.bleepingcomputer.com

    # Cisco warns of new # SDWAN zero-day exploited in attacks https://www. bleepingcomputer.com/news/secu rity/cisco-warns-of-new-sd-wan-authen

    www.bleepingcomputer.com · 11d ago · October 2nd, 2026

28. update from insomnisec.com

    Cisco Catalyst SD-WAN Manager Zero-Day (CVE-2026-76504): One Encoded Letter Away From Admin If your organisation uses Cisco SD-WAN to connec

    insomnisec.com · 11d ago · October 2nd, 2026

    Cisco Catalyst SD-WAN Manager Zero-Day (CVE-2026-76504): One Encoded Letter Away From Admin If your organisation uses Cisco SD-WAN to connec

    via Mastodon https://insomnisec.com/posts/2026-10-02-cisco-sd-wan-manager-cve-2026-76504_insomnisec_v1/

29. mentioned by dailytechnow.com

    Discover how a critical Cisco zero-day vulnerability in Catalyst SD-WAN Manager allowed attackers to bypass authentication with a single enc

    dailytechnow.com · 9d ago · October 4th, 2026

30. mentioned by meterpreter.org

    Discover how a single encoded character exploited a critical Cisco zero-day vulnerability in the Catalyst SD-WAN Manager, granting attackers

    meterpreter.org · 9d ago · October 4th, 2026