DaystoPatch

CiscoExploited incident

Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability

CVE-2026-76504Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 30 Sep 2026

  • Exploited before a fix
FixedFixed for every supported version under an hour after the first public report.
Embed this live clock

Response

Silence
0h
First public report to first vendor statement
Exposure
<1h
First public report to first fix
Follow-through
<1h
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Cisco advisory cisco-sa-sdwan-webauth-xr8beuuUClaimedQuote verified

    Initial public release.

    Vendor advisory was the first public report.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f78a406d60861dba…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    CISA KEV (CVE-2026-76504)ClaimedQuote verified30 Sep 2026

    Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

    Added to CISA's KEV catalog on 2026-09-30.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco PSIRT advisory cisco-sa-sdwan-webauth-xr8beuuUCuratedQuote not checked yet30 Sep 2026, 13:00 UTC

    In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.

    Exploitation was first disclosed by this advisory; timestamp is its 'First Published: 2026 September 30 13:00 GMT'. News coverage (Help Net Security 2026-10-01, The Hacker News) followed the advisory; no earlier public report found.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-76504ClaimedQuote verified30 Sep 2026, 13:04 UTC

    A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c2579fdba9923f48…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet30 Sep 2026, 13:13 UTC

    Cisco Catalyst SD-WAN Manager CVE-2026-76504, CVSS 9.8: unauthenticated API bypass to admin, exploited in the wild per Cisco. No workaround. Upgrade to 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet30 Sep 2026, 14:49 UTC

    Cisco Discloses SD-WAN Zero-Day Exploited in Attacks Cisco is urging organizations to act fast after discovering a critical zero-day vulnerability in its Catalyst SD-WAN Manager, which is already

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Cisco advisory cisco-sa-sdwan-webauth-xr8beuuUClaimedQuote verified

    Initial public release.

    From the advisory's revision history.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f78a406d60861dba…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Cisco PSIRT advisory cisco-sa-sdwan-webauth-xr8beuuUCuratedQuote verified30 Sep 2026, 13:00 UTC

    First Published: 2026 September 30 13:00 GMT

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f78a406d60861dba…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    +<1h

    Cisco PSIRT advisory cisco-sa-sdwan-webauth-xr8beuuUCuratedQuote verified

    However, as a mitigation for On-Prem deployment customer environments, they should restrict access from unsecured networks, such as the internet, to the system.

    Network-exposure mitigation in the Workarounds section; the only revision (1.1) changed the Summary, so this text is taken to be in v1.0 (2026-SEP-30). Cisco states there are no workarounds that address the vulnerability itself.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f78a406d60861dba…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Cisco PSIRT advisory cisco-sa-sdwan-webauth-xr8beuuU, revision 1.1CuratedQuote verified2 Oct 2026, 23:18 UTC

    Cisco has released a Live Protect shield for CVE-2026-76504 to provide temporary security coverage to allow time for software upgrade planning

    Revision 1.1 (2026-OCT-02) 'Added information about Live Protect shield availability.' Time is the page's 'Last Updated: 2026 October 2 23:18 GMT', which is the v1.1 timestamp.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f78a406d60861dba…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  4. First fix

    +<1h

    Cisco PSIRT advisory cisco-sa-sdwan-webauth-xr8beuuUCuratedQuote verified

    Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

    Advisory v1.0 (2026-SEP-30 13:00 GMT) shipped with fixed releases.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f78a406d60861dba…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    +<1h

    Cisco PSIRT advisory cisco-sa-sdwan-webauth-xr8beuuUCuratedQuote verified

    First Published: 2026 September 30 13:00 GMT

    Fixed-release table lists a fix for every supported train (20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, 26.2.1; earlier than 20.9: migrate). The revision history shows no later fixed-release additions, so all trains are treated as fixed at first publication.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f78a406d60861dba…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

Cisco SD-WAN Manager login bypass exploited; fixes for all supported trains

Attackers have exploited a flaw in Cisco Catalyst SD-WAN Manager that lets an unauthenticated person reach its API as the admin user; Cisco released fixes when it disclosed the attacks.

In plain words

Cisco's SD-WAN Manager, the central console that controls our wide-area network routers, had a flaw that let an outsider log in as the administrator without a password, and Cisco confirmed it was used in real attacks. Cisco published fixes for all supported versions on 30 September 2026, the same day it announced the problem. If we run SD-WAN Manager ourselves, we need to upgrade it to the fixed version for our release and check its logs for signs of break-in. Cisco's managed cloud version has already been fixed.

What happened and who is affected

What happened

On 30 September 2026 Cisco disclosed CVE-2026-76504, an authentication bypass in the API of Cisco Catalyst SD-WAN Manager, rated 9.8 out of 10. A crafted HTTP request with URI-encoded characters gets past an authentication rule and gives admin-level API access. Cisco said it became aware of active exploitation in September 2026 and published fixed releases for every supported train in the same advisory. On 2 October Cisco added a temporary 'Live Protect' shield for customers who cannot upgrade immediately.

Who is affected

Cisco Catalyst SD-WAN Manager (formerly vManage), on-premises, on releases before 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1; releases earlier than 20.9 must migrate. Cisco SD-WAN Cloud (Cisco Managed) is fixed in 20.15.605 with no customer action needed.

CVE-2026-76504. Reviewed 23 Oct 2026. https://daystopatch.com/incidents/cisco-cve-2026-76504/

Affected products

  • Cisco Catalyst SD-WAN Manager
  • Cisco SD-WAN Cloud (Cisco Managed)
How we built this timeline

Exploitation was disclosed in the same advisory that shipped fixes, so world = vendor = First fix. Help Net Security described it as the fifth actively exploited Cisco SD-WAN zero-day of 2026.

Cisco says the bug was found during the resolution of a Cisco TAC support case. The advisory's example IOC log line is timestamped 2026-09-29T23:11:13.948-05:00, but Cisco presents it as an example, not as the first observed attack.

Related

Cisco report card