CISA Warns Cisco Catalyst SD-WAN Manager Flaw CVE-2026-76504 Is Being Exploited

Attackers are exploiting a hex encoding flaw in Cisco Catalyst SD-WAN Manager, according to CISA, which added the bug, tracked as CVE-2026-76504, to its Known Exploited Vulnerabilities catalog on September 30, 2026.

At a glance

CVE

CVE-2026-76504

Vendor

Cisco

Product

Catalyst SD-WAN Manager

CVSS

9.8 CRITICAL

Weakness

hex encoding

Exploited

Yes (CISA KEV)

Ransomware use

Unknown

Patch deadline (FCEB)

October 3, 2026

What the flaw does

CISA's catalog entry describes the issue as follows: Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.

The National Vulnerability Database lists a CVSS base score of 9.8 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

The NVD record adds: A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentica

Affected products

Is it used by ransomware gangs?

CISA does not currently link this vulnerability to ransomware campaigns, but KEV listings mean exploitation has already been observed. Under CISA's binding operational directives, Federal Civilian Executive Branch agencies must remediate it by October 3, 2026. CISA urges every organisation, not only federal agencies, to treat KEV entries as a patching priority.

What should you do?

• Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• Apply the vendor's fix or mitigation now; CISA lists the bug as exploited in real attacks.
• If no patch is available, follow the vendor's workaround or take the product offline.
• Check logs on exposed systems for signs of compromise before and after patching.
• Restrict management interfaces so they are not reachable from the internet.

What to do and how to stay safe: CVE-2026-76504

• Patch scores alone ignore context like network exposure and asset criticality.
• You must map vulnerabilities to specific business risks to prioritize correctly.
• Continuous exposure data replaces static scanning for accurate prioritization.

Prioritize vulnerabilities by actual exploitability and business impact, not by theoretical severity scores. Update your asset context and exposure data continuously to maintain accurate risk rankings.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-76504?

CVE-2026-76504 is a hex encoding vulnerability in Cisco Catalyst SD-WAN Manager.

How severe is CVE-2026-76504?

It has a CVSS score of 9.8 CRITICAL.

Is CVE-2026-76504 being exploited?

Yes. CISA lists it in its Known Exploited Vulnerabilities catalog, which means attacks have been observed.

What is the deadline to patch CVE-2026-76504?

US federal civilian agencies must remediate it by October 3, 2026. Other organisations are urged to treat it as a priority.