Loading story…
Cisco disclosed CVE-2026-76504, a critical CVSS 9.8 authentication-bypass flaw in Cisco Catalyst SD-WAN Manager that is being actively exploited. Improper handling of URI encoding in API session authentication allows an unauthenticated remote attacker to evade login controls—such as by encoding j_security_check as %6a_security_check—and gain administrative API access. An attacker could then control managed devices and potentially compromise the entire SD-WAN environment.
Cisco has issued fixed releases for supported versions and says no workaround is available; organizations should patch immediately or disconnect vulnerable instances, particularly management interfaces exposed to the internet. Defenders should restrict management access to known IP addresses, enforce firewall protections, preserve evidence, and investigate /var/log/nms/serviceproxy-access.log and /var/log/nms/vmanage-server.log for /%6a_security_check, while recognizing that the indicator can also appear in legitimate activity.
See which actors are running it and whether you're in range.
9 events from the most recent confirmed update back to the earliest known activity.
Tenable published Nessus plugin 362627 to identify Cisco Catalyst SD-WAN Manager devices missing the vendor-supplied fix for CVE-2026-76504. The plugin checks the device's self-reported software version rather than attempting exploitation.
The Canadian Centre for Cyber Security published advisory AV26-978 concerning the actively exploited Cisco Catalyst SD-WAN Manager authentication-bypass flaw CVE-2026-76504. The advisory identified affected releases and urged administrators to review Cisco guidance and apply available updates.
CISA added Cisco Catalyst SD-WAN Manager vulnerability CVE-2026-76504 to its Known Exploited Vulnerabilities Catalog and required forensic triage. It directed stakeholders to follow Cisco mitigation guidance and BOD 26-04, with mitigation due by October 3, 2026.
Cisco advised customers to hunt for encoded j_security_check requests in service-proxy logs and requests associated with viptela-reserved- usernames in vManage logs, while cautioning that the indicators can occur legitimately. Cisco also stated that Cisco SD-WAN Cloud (Cisco Managed) release 20.15.605 had been remediated and required no customer action.
Cisco PSIRT had been aware of active exploitation of the Cisco Catalyst SD-WAN Manager authentication-bypass flaw since an unspecified point in September 2026. Exploitation uses URI encoding manipulation to bypass API authentication and obtain administrative access.
Cisco published Snort rule 67179 as defensive detection guidance for exploitation attempts targeting CVE-2026-76504. The rule supplements Cisco's log-based investigation recommendations for the actively exploited Catalyst SD-WAN Manager flaw.
VulnCheck reproduced CVE-2026-76504 and detailed how inconsistent URL decoding between WildFly security checks and Cisco's AppServerLoginModule can skip password validation. It reported that the viptela-reserved-cloudops and viptela-reserved-uc internal identities can provide administrator-level API access and estimated about 1,500 internet-exposed vManage instances.
A report described CVE-2026-76504 as a URI parser differential in which the front-end authentication filter fails to normalize encoded slashes or traversal sequences while the back-end router decodes them. It demonstrated a path that could reach the protected device-command API without a session and potentially retrieve the running configuration.
Cisco disclosed the critical CVE-2026-76504 authentication-bypass vulnerability in Catalyst SD-WAN Manager, rated CVSS 9.8, and published fixed releases for affected software trains. Cisco stated that no workaround is available and advised affected organizations to upgrade or disconnect vulnerable instances.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
34 references tracked. Mallory keeps watching after this page renders.
cirt.cm
Open sourcetenable.com
Open sourcewaterisac.org
Open sourcescworld.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcesec.cloudapps.cisco.com
Open sourcesdxcentral.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed and patched **CVE-2026-20182**, a critical `CVSS 10.0` authentication bypass flaw in **Cisco Catalyst SD-WAN Controller** and **Cisco Catalyst SD-WAN Manager** that has been exploited in the wild. The bug affects the `vdaemon` control-plane service over **DTLS/UDP 12346** and allows an unauthenticated attacker to impersonate a trusted peer, gain high-privilege administrative access, reach **NETCONF** on `TCP/830`, and manipulate SD-WAN fabric configuration. Rapid7 said the flaw stems from missing authentication checks when a peer claims to be a vHub device, enabling attackers to inject SSH keys for the `vmanage-admin` account and establish persistent access; Cisco said there are **no workarounds** and released fixed software versions for affected on-premises, cloud, managed-cloud, and FedRAMP deployments. Cisco Talos attributed the most sophisticated exploitation of `CVE-2026-20182` with high confidence to **UAT-8616**, which was observed adding SSH keys, modifying NETCONF settings, and escalating privileges to root, with infrastructure overlap noted with Operational Relay Box networks. Talos also reported broader ongoing attacks against SD-WAN environments, including widespread exploitation of previously disclosed **CVE-2026-20133**, **CVE-2026-20128**, and **CVE-2026-20122** after public proof-of-concept release, leading to deployment of JSP webshells such as **XenShell**, **Godzilla**, and **Behinder**, along with tools including Sliver, AdaptixC2, XMRig, gsocket, and credential-stealing scripts. **CISA added CVE-2026-20182 to the KEV catalog** and ordered federal agencies to remediate quickly, while Cisco and national cyber agencies urged organizations to preserve forensic evidence, review logs for unauthorized peering and `vmanage-admin` public-key logins, and patch all vulnerable control components immediately.
Aug 31, 2026
**CISA** ordered U.S. federal civilian agencies to urgently remediate a **critical Cisco Catalyst SD-WAN Manager compromise** tied to **CVE-2026-20127**, a `CVSS 10.0` authentication bypass flaw that allows attackers to obtain high-privilege access without valid credentials. Reporting indicates the activity was uncovered by **CISA** and **Cisco Talos**, which attributed exploitation to **UAT-8616** and assessed that the intrusions date back to 2023. Attackers reportedly maintained persistence by downgrading devices to older vulnerable software and then using the access to reach `NETCONF` and manipulate SD-WAN fabric configuration, creating significant risk for federal networks and other exposed deployments. Additional research shows the campaign is not limited to a single bug. Cisco disclosed in-the-wild exploitation of **CVE-2026-20127** together with **CVE-2022-20775**, an older SD-WAN CLI flaw enabling post-auth privilege escalation and root command execution, while external analysis warned that public proof-of-concept material around `CVE-2026-20127` has been misattributed and may produce incomplete detections. Researchers also highlighted broader exposure across internet-facing SD-WAN Manager instances and warned that **CVE-2026-20133** may present underappreciated risk and could already be seeing exploitation, underscoring that defenders should treat the Cisco SD-WAN issue as an active intrusion and hardening priority rather than a routine patch cycle.
Jun 29, 2026
Cisco released fixes for **CVE-2026-20262**, an actively exploited vulnerability in **Cisco Catalyst SD-WAN Manager** (`vManage`) that allows an authenticated remote attacker with low privileges to upload or overwrite files through crafted HTTP requests and ultimately execute commands as **root**. The flaw stems from insufficient validation of user-supplied input during file uploads in the web UI and affects **all deployment models**, including on-premises, Cloud-Pro, Cisco-managed cloud, and FedRAMP environments. Cisco said it became aware of in-the-wild exploitation in June and urged customers to patch immediately, warning that the product’s central role in orchestrating SD-WAN fabrics raises the operational impact of compromise. The company published indicators of compromise tied to uploaded `.jsp` and `.war` files, including filenames such as `index.jsp` and `suspicious.war`, and advised defenders to inspect `vmanage-server`, `vmanage-appserver`, and `serviceproxy-access` logs, reduce internet exposure, audit accounts, and contact TAC with an admin-tech file if intrusion is suspected.
Aug 15, 2026