CISA put SD-WAN Manager on KEV. The May peering patch does not close the API.

CVE-2026-76504 is unauthenticated admin on every Catalyst SD-WAN Manager. There is no workaround. The May and June builds are still in.

RWP Ventures · 2026-10-01 · event 2026-09-30 · 13 min read · priority 9.0

The product is Cisco Catalyst SD-WAN Manager (vManage). The bug is unauthenticated admin API access on every deployment, including default configuration. Cisco’s CNA score is 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-177, improper handling of URL encoding). There is no feature to turn off. Cisco has not published a workaround. The fix is a build.

Do not collapse four facts.

1. This is not May’s peering bypass with a new CVE. CVE-2026-20182 (KEV 14 May, due 17 May) and CVE-2026-20127 (KEV 25 February) were control-connection / peering authentication. CVE-2026-76504 is a session API path: a crafted HTTP request with one URI-encoded character slips past the rule that was supposed to protect j_security_check. Same product class, different CWE, different floors.
2. The May and June SD-WAN patches do not close this. First fixed releases for 20182 sat at 20.9.9.1 / 20.12.7.1 / 20.15.4.4 / 20.18.2.2 / 26.1.1.1. Today’s floors are 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, 26.2.1. A Manager last upgraded for the spring campaign is still in.
3. A firmware bump is not forensic triage. CISA flags Yes on this row. Cisco’s own IOC examples are in serviceproxy-access.log and vmanage-server.log. The advisory does not say the upgrade evicts an attacker who already holds the admin API. Treat internet-reachable Managers as hunt-then-patch, not patch-and-close.
4. Yesterday’s NetScaler clock expired. That is not this interrupt. Catalog 2026.09.29 added Apple CVE-2026-86950 (due 2 October). Catalog 2026.09.30 added this Cisco row (due 3 October). NetScaler CVE-2026-88771 / 88772 were due 30 September. Those tickets stay open. The new operational ticket is the SD-WAN control plane.

What happened

Wednesday 30 September 13:00 GMT, Cisco published advisory cisco-sa-sdwan-webauth-xr8beuuU, version 1.0, marked Final. Bug CSCww79570. Same day, CISA put the CVE on KEV.

Cisco PSIRT: it became aware of active exploitation in September 2026. The vulnerability was found during resolution of a TAC support case. The advisory does not name a customer, a count, a cluster, or a post-exploit kit.

The mechanism, as Cisco wrote it: API session-based authentication mishandles URI encoding in an HTTP request. The encoding makes an authentication rule fail to match, so the request reaches a restricted API endpoint. A successful exploit yields the API as the admin user. By default that account holds the netadmin role, which Cisco documents as permitted to perform all operations on the device — and therefore on the SD-WAN fabric the Manager steers.

Cisco’s hunt example encodes the letter j in j_security_check as /%6a_security_check. The advisory is explicit that any one encoded character works; %6a is not a signature. The sample log lines use RFC1918 addresses and a vmanage-9999.example.com host. Do not treat those as campaign infrastructure.

Two files Cisco wants audited, for j_security_check from unknown or unauthorized IPs:

• /var/log/nms/containers/service-proxy/serviceproxy-access.log — example form: POST /%6a_security_check HTTP/1.1 returning 200.
• /var/log/nms/vmanage-server.log — same path stored for a user whose name starts with viptela-reserved-. Those names are reserved system service accounts in Cisco’s AAA guide, not a cluster ID.

Cisco cautions that the same strings can appear in normal operations. A match is a lead, not a conviction.

Cisco-managed SD-WAN Cloud is already on 20.15.605. No customer action on that service. On-prem and customer-managed Managers are the ticket. Cloud-hosted environments already have the internet-restriction mitigation Cisco describes; that is not a substitute for the build.

Cisco published Snort rule 67179 against the advisory. Rapid7 told its Exposure Command / Nexpose customers to expect a check in the 1 October content drop.

Why it matters

SD-WAN Manager is not an edge VPN concentrator. It is the controller that templates, pushes, and audits the WAN: policies, certificates, device lists, routing, and the administrative plane for every vEdge / cEdge / Catalyst that reports to it. Unauthenticated admin API on that box is not “a web CVE on a management GUI.” It is a path to fabric-wide configuration.

Three operational lies are now in the ticket.

1. “We patched SD-WAN in May / June.” False for this CVE. The spring floors are inside today’s affected ranges. Rapid7’s 30 September note is the same cut: CVE-2026-20127 and Rapid7-discovered CVE-2026-20182 were distinct vdaemon / peering issues. This one is a separate API authentication path.
2. “It is not internet-facing, so we can wait.” Cisco: Managers with ports on the internet are at risk. The vulnerability still exists regardless of configuration. Reachability is the exploit precondition, not a feature flag. If the GUI/API is reachable from an untrusted network, the encoding bypass applies.
3. “We will take 20.9.10.1 in the next change window.” Incomplete. CISA’s forensic-triage flag is Yes, unlike the prior eight Cisco SD-WAN KEV rows we retrieved, which were No. BOD 26-04 already told FCEB to check whether the actor was on the box before the patch. Cisco’s May/June SD-WAN advisories said an update alone would not resolve a confirmed compromise and told customers to collect admin-tech first. This advisory does not repeat that sentence. Do not infer that the omission means the ISO cleans the box.

This is the ninth Cisco SD-WAN row on KEV (including CVE-2022-20775, added 25 February). Eight of those nine were added in 2026. Recurrence is CONFIRMED as a targeting pattern. Continuity of UAT-8616 or any other named cluster onto CVE-2026-76504 is UNKNOWN. Cisco did not make that join. Neither did CISA.

A Manager that also steers circuits into industrial sites is still an IT control-plane compromise until evidence shows process impact. None is in this record.

Who / what is affected

The 30 September advisory does not list the 20.10, 20.11, 20.13, 20.14, or 20.16 trains that earlier SD-WAN advisories named, and it does not name Cloud-Pro or FedRAMP SKUs. Treat unlisted trains as UNKNOWN pending Cisco, not as cleared. Confirm the running image against the compatibility matrix before you write “not in scope” on a ticket.

Technical context

RWP is not reproducing encoded request variants, session-cookie handling, or API methods that follow a successful bypass. Cisco’s published defender cut is enough: the authentication rule matches a literal path; one percent-encoded character makes the match fail; the request is then handled as the admin user.

What to hunt, from Cisco’s published guidance — logs and accounts, not an exploit path:

• serviceproxy-access.log: POST (or other methods) to j_security_check with any %HH substitution in the path, especially from addresses that are not your jump hosts.
• vmanage-server.log: Request Stored in Map is (/…_security_check) for users viptela-reserved-….
• Unexpected sessions, users, or API tokens created around the same timestamps.
• Configuration diffs on the fabric after those timestamps: device templates, feature templates, certificate changes, new control connections, unexpected NETCONF/SSH to edges.
• External logging, if you have it. Cisco’s hardening note: keep web logs off-box long enough to investigate.

ATT&CK mapping for the ticket, not a kill chain we ran:

Horizon3 published that it reversed the bug and shipped a NodeZero Rapid Response test on 30 September. That is a commercial scanner claim, not a public PoC we are repeating, and not evidence of a second in-the-wild cluster.

Threat / exploitation status

Confidence on the vulnerability, the KEV clock, the no-workaround sentence, and the version-math split from May/June: high. Confidence on actor, victim count, and what the admin API was used for: low. Confidence on “this is UAT-8616 again”: low until Cisco, CISA, or a primary hunt publishes the join.

What defenders should do

1. Inventory every Catalyst SD-WAN Manager — on-prem, customer-managed cloud image, lab, DR. Record the running version. Anything below the floors in the table is in. Do not skip boxes that took the May/June SD-WAN advisories. Confirm unlisted trains with Cisco, do not assume they are out.
2. If the GUI or API is reachable from an untrusted network, treat that as the exploit condition. Pull it behind a jump host / management subnet. Cisco’s hardening guide already said ports 443 / 22 / 830 should not face the internet. That restriction is a mitigation, not a fix. Cloud-hosted environments already have it; still verify the image.
3. Preserve, then hunt, then patch. request admin-tech before you upgrade. Collect serviceproxy-access.log and vmanage-server.log off-box. Open a Severity 3 TAC case with CVE-2026-76504 in the title if the logs are ugly. BOD 26-04: the update can destroy the evidence. Hunt for encoded j_security_check, viptela-reserved- sessions from unexpected IPs, and fabric config drift.
4. Install the fixed build for your train. There is no published workaround. Restricting internet access is the delay, not the closure. Cisco-managed Cloud on 20.15.605 needs no customer patch; confirm you are actually on that service before you write N/A.
5. If you find a successful bypass: isolate the Manager, freeze template pushes, rotate. Admin and operator passwords, API tokens, control-plane certs, edge login credentials the Manager could have stored or pushed, and any SSH keys or NETCONF trust the fabric used. Recheck edge running-config against last-known-good. Do not assume a clean Manager GUI means clean vEdges.
6. Keep the rest of this window on the board. Apple CVE-2026-86950 is KEV, due tomorrow, 2 October. NetScaler 88771/88772 were due 30 September; [WHIPSHOT/SLAPSHOT](/posts/2026-09-30-netscaler-whipshot-slapshot/) survive the ISO. SharePoint CVE-2026-65660, WordPress CVE-2026-87902, and MikroTik CVE-2026-67279 were due 28 September. The SD-WAN controller is today’s interrupt; those clocks did not pause.

RWP assessment

Score 9.0.

Highest-leverage development since yesterday’s NetScaler hunt is a new KEV row on the box that configures the WAN: unauthenticated admin API, default config, no workaround, forensic triage Yes, due 3 October, and version math that leaves the May/June SD-WAN patched fleet inside the range. Evidence quality is high: Cisco PSIRT primary, CISA JSON, CVE/NVD, Rapid7 ETR.

It outranks Microsoft’s 30 September CVE-2026-73570 Zimbra hunt because that CVE has been on KEV since 21 August (due 24 August); the new write-up is a post-exploit kit on an optional SNMP-notification path, not a new perimeter zero-day. It outranks a second day on Apple CVE-2026-86950 because yesterday already assessed the CoreGraphics bug; the due date is tomorrow, not a new exploitation picture. It outranks FTAPI / The Gentlemen (company says one internal server, platform and customer transfers not affected) because that is a contained vendor incident, not a control-plane CVE. It outranks the week’s CISA ICS advisory batch because we retrieved no in-the-wild claim in this window.

What we are not saying: that UAT-8616 owns this CVE; that ransomware is using it; that every j_security_check log line is exploitation; that Cisco-managed Cloud customers must patch; that a Manager steering an industrial site is confirmed process impact.

What we are watching

• Whether Cisco or CISA names a cluster, a victim sector, or a post-exploit kit.
• Whether unlisted release trains (20.10–20.16, Cloud-Pro, FedRAMP) get an explicit in/out.
• Whether upgrading without a hunt becomes the failure mode, as it did on NetScaler this week.
• Apple CVE-2026-86950 due 2 October — clock, not this story.
• Microsoft’s Zimbra CVE-2026-73570 hunt (JSP shells, PAM/sudo abuse, mailbox-secret collection) as a follow-on, not today’s interrupt.
• Whether 88773–88778 on NetScaler pick up exploitation and join KEV.

Sources

• Cisco PSIRT — cisco-sa-sdwan-webauth-xr8beuuU (CVE-2026-76504)
• CISA — Adds one known exploited vulnerability (30 September 2026)
• CISA — KEV JSON catalog 2026.09.30
• CISA — Known Exploited Vulnerabilities Catalog
• CISA — BOD 26-04
• CVE-2026-76504 · NVD
• Rapid7 — ETR CVE-2026-76504 (30 September 2026)
• The Hacker News — Cisco warns of attackers exploiting SD-WAN Manager
• SecurityWeek — Cisco patches exploited Catalyst SD-WAN zero-day
• NZ NCSC — CVE-2026-76504
• CIS MS-ISAC 2026-105
• Horizon3 — CVE-2026-76504
• CISA — Guidance on global exploitation of Cisco SD-WAN systems (updated 14 May 2026)