Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)

Reported by Rapid7

Summary by Cyber Security News30 Sep 2026, 17:09 CEST

About this summary. This is a short, independently written summary of an article first published by Rapid7. Cyber Security News did not report or verify the underlying story. Read the original: https://www.rapid7.com/blog/post/etr-critical-cisco-catalyst-sd-wan-manager-api-authentication-bypass-exploited-in-the-wild-cve-2026-76504

OverviewOn September 30, 2026, Cisco published a security advisory for CVE-2026-76504, a critical API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager. The vulnerability has a CVSSv3.1 score of 9.8 and results from improper handling of URL encoding (CWE-177).

Read the full article at Rapid7 →

Source attribution: headline and facts are from Rapid7 (rapid7.com). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager

Cisco warns of new SD-WAN zero-day exploited in attacks

Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability

NCSC-2026-0395 [1.00] [M/H] Kwetsbaarheid verholpen in Cisco Catalyst SD-WAN Manager

Cisco Advance Notification for Publication of October 7, 2026, Security Advisories

China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor