CVE-2026-76504
Cisco Catalyst SD-WAN Manager: Hex Encoding
As of , CVE-2026-76504 in Cisco Catalyst SD-WAN Manager is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch now.
- Exploited
- Yes: CISA listed it on 30 September 2026
- US federal deadline
- 3 October 20263 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- Not known to CISA
- Forensic triage
- Required by CISA under BOD 26-04Agencies must also look for signs that attackers already got in.
- EPSS score
- 0.02Higher than 78% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- Public exploit
- None foundNeither Metasploit nor Exploit-DB lists one.
- Fix
- Vendor advice: sec.cloudapps.cisco.comLinks below, from CISA's entry.
What CISA says to do
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA's required action
What the flaw is
Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.
CISA's description
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.
The CVE record's description, from cisco
- CVE published
- 30 September 2026
- Assigned by
- cisco
- CVSS
- 9.8 Critical (CVSS 3.1, from the CNA)
- CWE-177
- Improper Handling of URL Encoding (Hex Encoding)
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- yes
- CISA SSVC, technical impact
- total
Timeline
- The CVE record was published.
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
Catalyst SD-WAN Manager: other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2026-20262Directory or Path Traversal | Cisco Catalyst SD-WAN Manager | Patch soon | 0.28 | ||
| CVE-2026-20133Exposure of Sensitive Information to an Unauthorized Actor | Cisco Catalyst SD-WAN Manager | Patch soon | 0.32 | ||
| CVE-2026-20245Improper Encoding or Escaping of Output | Cisco Catalyst SD-WAN Manager | Patch soon | 0.25 | ||
| CVE-2026-20128Storing Passwords in a Recoverable Format | Cisco Catalyst SD-WAN Manager | Patch soon | 0.07 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org