--- title: Cisco SD-WAN Manager hit by zero-day admin access attack description: Attackers are actively exploiting a critical authentication bypass vulnerability (CVE-2026-76504, CVSS 9.8) in Cisco Catalyst SD-WAN Manager, allowing remote... canonical: https://daily.dev/posts/cisco-sd-wan-manager-hit-by-zero-day-admin-access-attack-dxcmchxcw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cisco SD-WAN Manager hit by zero-day admin access attack | daily.dev og:description: Attackers are actively exploiting a critical authentication bypass vulnerability (CVE-2026-76504, CVSS 9.8) in Cisco Catalyst SD-WAN Manager, allowing remote... og:url: https://daily.dev/posts/cisco-sd-wan-manager-hit-by-zero-day-admin-access-attack-dxcmchxcw og:image: https://api.daily.dev/og/posts/dxCMChxCw.png og:image:alt: Cisco SD-WAN Manager hit by zero-day admin access attack og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cisco SD-WAN Manager hit by zero-day admin access attack **[CSO Online](https://daily.dev/sources/csoonline)** · 4 min read · 0 upvotes · 0 comments ## Summary Attackers are actively exploiting a critical authentication bypass vulnerability (CVE-2026-76504, CVSS 9.8) in Cisco Catalyst SD-WAN Manager, allowing remote access to its administrative API without credentials due to improper URI encoding handling in HTTP requests. Affected releases include 20.9 and earlier, 20.12, 20.15, 20.18, 26.1, and 26.2; Cisco's cloud-managed SD-WAN service is already patched. There is no workaround, so Cisco urges immediate upgrading and restricting management interface access from untrusted networks. IDC's Sakshi Grover warns that admin API access could let attackers map network topology, alter policies, weaken segmentation, or push unauthorized configuration changes across thousands of connected devices. Cisco provides log indicators (serviceproxy-access.log, vmanage-server.log) to detect prior exploitation and recommends rotating credentials and submitting admin-tech files to its Technical Assistance Centre for compromise analysis. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-76504 in Cisco Catalyst SD-WAN Manager? CVE-2026-76504 is a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager with a CVSS score of 9.8. Improper handling of URI encoding in HTTP requests lets attackers bypass authentication on a specific API endpoint, granting them administrator-level access remotely without credentials or user interaction via a crafted HTTP request. _Teams running Cisco SD-WAN track critical advisories like this one through daily.dev._ ### Which Cisco SD-WAN Manager versions are affected by the authentication bypass flaw and is there a workaround? Affected releases include 20.9 and earlier, 20.12, 20.15, 20.18, 26.1, and 26.2; Cisco's cloud-managed SD-WAN service has already been fixed. There is no workaround, so Cisco recommends restricting management interface access from unsecured networks until administrators can upgrade to the patched release for their version. _Admins planning an urgent SD-WAN Manager upgrade can follow coverage of patch rollouts on daily.dev._ ### How can I check if my Cisco SD-WAN Manager was already compromised by the j_security_check authentication bypass? Check serviceproxy-access.log for requests to the j_security_check endpoint from unknown IP addresses, including URI-encoded variants like /%6a_security_check. Also inspect vmanage-server.log for encoded j_security_check requests tied to usernames starting with viptela-reserved-, which are reserved system service accounts, and submit admin-tech files to Cisco TAC for deeper analysis. _Security teams investigating SD-WAN compromise indicators follow incident breakdowns like this on daily.dev._ ## Similar posts on daily.dev - [Attackers exploiting unpatched Cisco SD-WAN flaw](https://daily.dev/posts/attackers-exploiting-unpatched-cisco-sd-wan-flaw-flftxgm0p) · CSO Online · 0 upvotes · 0 comments - [Cisco fixes SD-WAN vManage flaw exploited in zero-day attacks](https://daily.dev/posts/cisco-fixes-sd-wan-vmanage-flaw-exploited-in-zero-day-attacks-haaubkuic) · BleepingComputer · 0 upvotes · 0 comments - [Zero-Day Exploitation of Vulnerability \(CVE-2026-20245\) in Cisco Catalyst SD-WAN Manager](https://daily.dev/posts/zero-day-exploitation-of-vulnerability-cve-2026-20245-in-cisco-catalyst-sd-wan-manager-iuhsybebg) · Google Cloud · 0 upvotes · 0 comments - [Cisco patches SD-WAN flaw amid evidence of active exploitation](https://daily.dev/posts/cisco-patches-sd-wan-flaw-amid-evidence-of-active-exploitation-yyywuxmf1) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#networking](https://daily.dev/tags/networking), [#cisco](https://daily.dev/tags/cisco) [View this post on daily.dev](https://daily.dev/posts/cisco-sd-wan-manager-hit-by-zero-day-admin-access-attack-dxcmchxcw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Cisco SD-WAN Manager hit by zero-day admin access attack","url":"https://daily.dev/posts/cisco-sd-wan-manager-hit-by-zero-day-admin-access-attack-dxcmchxcw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cisco-sd-wan-manager-hit-by-zero-day-admin-access-attack-dxcmchxcw"},"datePublished":"2026-10-01T13:37:30.989Z","dateModified":"2026-10-01T13:58:23.777Z","description":"Attackers are actively exploiting a critical authentication bypass vulnerability (CVE-2026-76504, CVSS 9.8) in Cisco Catalyst SD-WAN Manager, allowing remote...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b5010eaa205d099cedee57fc37ac92ea?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b5010eaa205d099cedee57fc37ac92ea?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cisco-sd-wan-manager-hit-by-zero-day-admin-access-attack-dxcmchxcw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,networking,cisco","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Cisco SD-WAN Manager hit by zero-day admin access attack"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cisco-sd-wan-manager-hit-by-zero-day-admin-access-attack-dxcmchxcw#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-76504 in Cisco Catalyst SD-WAN Manager?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-76504 is a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager with a CVSS score of 9.8. Improper handling of URI encoding in HTTP requests lets attackers bypass authentication on a specific API endpoint, granting them administrator-level access remotely without credentials or user interaction via a crafted HTTP request. Teams running Cisco SD-WAN track critical advisories like this one through daily.dev."}},{"@type":"Question","name":"Which Cisco SD-WAN Manager versions are affected by the authentication bypass flaw and is there a workaround?","acceptedAnswer":{"@type":"Answer","text":"Affected releases include 20.9 and earlier, 20.12, 20.15, 20.18, 26.1, and 26.2; Cisco's cloud-managed SD-WAN service has already been fixed. There is no workaround, so Cisco recommends restricting management interface access from unsecured networks until administrators can upgrade to the patched release for their version. Admins planning an urgent SD-WAN Manager upgrade can follow coverage of patch rollouts on daily.dev."}},{"@type":"Question","name":"How can I check if my Cisco SD-WAN Manager was already compromised by the j_security_check authentication bypass?","acceptedAnswer":{"@type":"Answer","text":"Check serviceproxy-access.log for requests to the j_security_check endpoint from unknown IP addresses, including URI-encoded variants like /%6a_security_check. Also inspect vmanage-server.log for encoded j_security_check requests tied to usernames starting with viptela-reserved-, which are reserved system service accounts, and submit admin-tech files to Cisco TAC for deeper analysis. Security teams investigating SD-WAN compromise indicators follow incident breakdowns like this on daily.dev."}}]} ```