cisco-sa-sdwan-webauth-xr8beuuUCriticalCVSS 9.8

Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability

Published
September 30, 2026
Last Modified
October 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-76504 →

📋 Description

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.

This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Live Protect Shield

Cisco has released a Live Protect shield for CVE-2026-76504 to provide temporary security coverage to allow time for software upgrade planning, including preserving any information that customers may require for governance or compliance purposes.

This shield offers only temporary partial protection. The only way to remediate this vulnerability is to upgrade to the first fixed software release, as noted in the Fixed Releases ["#fs"] section of this advisory. Cisco strongly recommends prioritizing system upgrades and scheduling them as soon as possible to ensure remediation.

Before deploying the shield, read the following information:

Side Effects/Limitation: If this shield is applied

A legitimate user with URI encoding might not be able to login to SDWAN Manager.

For more information about Live Protect for Cisco Catalyst SD-WAN, see https://www.cisco.com/c/en/us/td/docs/routers/sdwan/26x-later/network-monitoring/network-monitoring-guide/live-protect-for-cisco-catalyst-sd-wan.html ["https://www.cisco.com/c/en/us/td/docs/routers/sdwan/26x-later/network-monitoring/network-monitoring-guide/live-protect-for-cisco-catalyst-sd-wan.html"].

CVE-2026-76504 — Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability (CVSS 3.1 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

🎯 Affected products401

  • Cisco Catalyst SD-WAN Manager
  • Cisco Catalyst SD-WAN Manager 17.2.10
  • Cisco Catalyst SD-WAN Manager 17.2.4
  • Cisco Catalyst SD-WAN Manager 17.2.5
  • Cisco Catalyst SD-WAN Manager 17.2.6
  • Cisco Catalyst SD-WAN Manager 17.2.7
  • Cisco Catalyst SD-WAN Manager 17.2.8
  • Cisco Catalyst SD-WAN Manager 17.2.9
  • Cisco Catalyst SD-WAN Manager 18.2.0
  • Cisco Catalyst SD-WAN Manager 18.3.0
  • Cisco Catalyst SD-WAN Manager 18.3.1
  • Cisco Catalyst SD-WAN Manager 18.3.1.1
  • Cisco Catalyst SD-WAN Manager 18.3.3
  • Cisco Catalyst SD-WAN Manager 18.3.3.1
  • Cisco Catalyst SD-WAN Manager 18.3.4
  • Cisco Catalyst SD-WAN Manager 18.3.5
  • Cisco Catalyst SD-WAN Manager 18.3.6
  • Cisco Catalyst SD-WAN Manager 18.3.6.1
  • Cisco Catalyst SD-WAN Manager 18.3.7
  • Cisco Catalyst SD-WAN Manager 18.3.8
  • Cisco Catalyst SD-WAN Manager 18.4.0
  • Cisco Catalyst SD-WAN Manager 18.4.0.1
  • Cisco Catalyst SD-WAN Manager 18.4.1
  • Cisco Catalyst SD-WAN Manager 18.4.3
  • Cisco Catalyst SD-WAN Manager 18.4.302
  • Cisco Catalyst SD-WAN Manager 18.4.303
  • Cisco Catalyst SD-WAN Manager 18.4.4
  • Cisco Catalyst SD-WAN Manager 18.4.5
  • Cisco Catalyst SD-WAN Manager 18.4.501_ES
  • Cisco Catalyst SD-WAN Manager 18.4.6
  • +371 more not shown

✅ Remediation

Cisco has released software updates that address this vulnerability. https://software.cisco.com Workarounds: There are no workarounds that address this vulnerability. However, as a mitigation for On-Prem deployment customer environments, they should restrict access from unsecured networks, such as the internet, to the system. If access to the system is required from the internet, restrict system access to only known, trusted hosts on ports and protocols that are included in the user guides. Protect Cisco Catalyst SD-WAN Control Components behind a filtering device such as a firewall, and filter traffic to and from the system while allowing only known, trusted hosts to send traffic to the system. For more information, see the Cisco Catalyst SD-WAN Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/Cisco-Catalyst-SD-WAN-HardeningGuide#net"]. For Cisco Catalyst SD-WAN Cloud Hosted environments, this mitigation is already deployed. While this mitigation has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

🔗 References (7)