Cisco Patches Critical SD-WAN Manager Zero-Day Under Active Attack

A critical zero-day vulnerability in Cisco's Catalyst SD-WAN Manager is being actively exploited by threat actors to obtain administrative privileges on unpatched systems. Tracked as CVE-2026-76504, the flaw affects the network management platform that enables administrators to oversee and control as many as 6,000 SD-WAN devices through a single interface. The software was previously branded as SD-WAN vManage.

Cisco disclosed the issue on Wednesday, stating that "In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." The company emphasized that "Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability."

The flaw resides in the platform's API session-based authentication handling and permits unauthenticated attackers to gain remote access with full administrative rights, regardless of how the system is configured. According to Cisco, "This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint."

Attackers exploit the vulnerability by crafting malicious HTTP requests directed at the affected system's API. Cisco revealed that threat actors are leveraging %6a, the URI-encoded representation of the character "j", in their attack payloads.

Organizations investigating potential compromises should examine two log files for suspicious activity originating from unknown or unauthorized sources. These include the serviceproxy-access.log file located in /var/log/nms/containers/service-proxy and the vmanage-server.log file in /var/log/nms/, specifically searching for entries referencing j_security_check.

Cisco advised that organizations needing assistance determining whether their Catalyst SD-WAN Manager deployment has been compromised should contact Cisco Technical Assistance Center (TAC) and prepare admin-tech files to facilitate the investigation.

Fifth SD-WAN zero-day weaponized in 2026

This represents the fifth SD-WAN zero-day vulnerability that has been actively exploited in the wild since January 2026. Earlier in the year, Cisco addressed an information disclosure flaw in SD-WAN Manager (CVE-2026-20127) in February, which had been under attack since at least 2023. In May, the company patched a maximum-severity authentication bypass in Catalyst SD-WAN Controller (CVE-2026-20182) that attackers were already weaponizing to obtain administrative access on unpatched infrastructure.

Two additional SD-WAN zero-days emerged in early June when Cisco warned of CVE-2026-20245 and CVE-2026-20262, both being exploited by attackers to achieve root-level access on compromised systems.

The Cybersecurity and Infrastructure Security Agency (CISA) has cataloged 90 Cisco vulnerabilities as exploited in the wild since November 2021. Of these, four have targeted Catalyst SD-WAN Manager specifically, and seven have been leveraged by ransomware operations.