<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/cisco-warns-of-new-sd-wan-zero-day-exploited-in-attacks-qn1wtr70y" -->

---
title: Cisco warns of new SD-WAN zero-day exploited in attacks
description: Cisco has released patches for a critical zero-day vulnerability (CVE-2026-76504) in Catalyst SD-WAN Manager that is being actively exploited to gain...
canonical: https://daily.dev/posts/cisco-warns-of-new-sd-wan-zero-day-exploited-in-attacks-qn1wtr70y
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: Cisco warns of new SD-WAN zero-day exploited in attacks | daily.dev
og:description: Cisco has released patches for a critical zero-day vulnerability (CVE-2026-76504) in Catalyst SD-WAN Manager that is being actively exploited to gain...
og:url: https://daily.dev/posts/cisco-warns-of-new-sd-wan-zero-day-exploited-in-attacks-qn1wtr70y
og:image: https://api.daily.dev/og/posts/QN1wtR70y.png
og:image:alt: Cisco warns of new SD-WAN zero-day exploited in attacks
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Cisco warns of new SD-WAN zero-day exploited in attacks

**[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments

## Summary

Cisco has released patches for a critical zero-day vulnerability (CVE-2026-76504) in Catalyst SD-WAN Manager that is being actively exploited to gain unauthenticated admin access. The flaw stems from improper URI encoding handling that lets a crafted HTTP request bypass an authentication rule protecting an API endpoint, affecting all configurations. Cisco published IOCs, including the use of %6a-encoded characters in malicious requests, and pointed admins to specific log files to check for compromise. This is the fifth actively exploited SD-WAN zero-day of the year, following earlier flaws patched in February, May, and June.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.bleepingcomputer.com/news/security/cisco-warns-of-new-sd-wan-authentication-bypass-zero-day-exploited-in-attacks>

## Questions this post answers

### What is CVE-2026-76504 and how does it affect Cisco Catalyst SD-WAN Manager?

CVE-2026-76504 is a critical zero-day in Cisco Catalyst SD-WAN Manager caused by improper handling of URI encoding in HTTP requests, letting the request bypass an authentication rule meant to restrict access to a specific API endpoint. This lets unauthenticated attackers remotely gain admin privileges on affected systems, regardless of configuration, and is being actively exploited.

_Teams running Cisco SD-WAN can track emerging exploited CVEs like this one on daily.dev._

### Which Cisco Catalyst SD-WAN Manager versions fix CVE-2026-76504?

Fixes are available for release 20.9 in 20.9.10.1, 20.12 in 20.12.8.2, 20.15 in 20.15.6.1, 20.18 in 20.18.4.1, 26.1 in 26.1.2.1, and 26.2 in 26.2.1. Versions earlier than 20.9 have no fix and must be migrated to a supported release. Cisco strongly recommends upgrading to a fixed release to remediate the vulnerability.

_Admins planning SD-WAN patch cycles can follow version-specific fixes like these via daily.dev._

### How can I tell if my Cisco SD-WAN Manager was compromised by the CVE-2026-76504 exploit?

Check the serviceproxy-access.log file under /var/log/nms/containers/service-proxy and the vmanage-server.log file under /var/log/nms/ for j_security_check entries from unknown or unauthorized IP addresses. Attackers use %6a, the URI-encoded character for 'j', in malicious requests. Cisco TAC can assist further after admins collect admin-tech files for review.

_Incident responders investigating SD-WAN compromises can find fresh IOC reports like this on daily.dev._

## Similar posts on daily.dev

- [Cisco warns of unpatched SD-WAN zero-day exploited in attacks](https://daily.dev/posts/cisco-warns-of-unpatched-sd-wan-zero-day-exploited-in-attacks-y5x7rn4ph) · BleepingComputer · 0 upvotes · 0 comments
- [Cisco warns of two more SD-WAN bugs under active attack](https://daily.dev/posts/cisco-warns-of-two-more-sd-wan-bugs-under-active-attack-t3izwwzac) · The Register · 0 upvotes · 0 comments
- [Attackers exploiting unpatched Cisco SD-WAN flaw](https://daily.dev/posts/attackers-exploiting-unpatched-cisco-sd-wan-flaw-flftxgm0p) · CSO Online · 0 upvotes · 0 comments
- [Cisco fixes SD-WAN vManage flaw exploited in zero-day attacks](https://daily.dev/posts/cisco-fixes-sd-wan-vmanage-flaw-exploited-in-zero-day-attacks-haaubkuic) · BleepingComputer · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#networking](https://daily.dev/tags/networking), [#cisco](https://daily.dev/tags/cisco), [#zero-day](https://daily.dev/tags/zero-day)

[View this post on daily.dev](https://daily.dev/posts/cisco-warns-of-new-sd-wan-zero-day-exploited-in-attacks-qn1wtr70y)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"Cisco warns of new SD-WAN zero-day exploited in attacks","url":"https://daily.dev/posts/cisco-warns-of-new-sd-wan-zero-day-exploited-in-attacks-qn1wtr70y","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cisco-warns-of-new-sd-wan-zero-day-exploited-in-attacks-qn1wtr70y"},"datePublished":"2026-09-30T14:47:12.186Z","dateModified":"2026-10-01T13:58:21.894Z","description":"Cisco has released patches for a critical zero-day vulnerability (CVE-2026-76504) in Catalyst SD-WAN Manager that is being actively exploited to gain...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bb3ca028e6217a145cf2058b8e86cf64?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bb3ca028e6217a145cf2058b8e86cf64?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cisco-warns-of-new-sd-wan-zero-day-exploited-in-attacks-qn1wtr70y","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,networking,cisco,zero-day","timeRequired":"PT3M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Cisco warns of new SD-WAN zero-day exploited in attacks"}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cisco-warns-of-new-sd-wan-zero-day-exploited-in-attacks-qn1wtr70y#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-76504 and how does it affect Cisco Catalyst SD-WAN Manager?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-76504 is a critical zero-day in Cisco Catalyst SD-WAN Manager caused by improper handling of URI encoding in HTTP requests, letting the request bypass an authentication rule meant to restrict access to a specific API endpoint. This lets unauthenticated attackers remotely gain admin privileges on affected systems, regardless of configuration, and is being actively exploited. Teams running Cisco SD-WAN can track emerging exploited CVEs like this one on daily.dev."}},{"@type":"Question","name":"Which Cisco Catalyst SD-WAN Manager versions fix CVE-2026-76504?","acceptedAnswer":{"@type":"Answer","text":"Fixes are available for release 20.9 in 20.9.10.1, 20.12 in 20.12.8.2, 20.15 in 20.15.6.1, 20.18 in 20.18.4.1, 26.1 in 26.1.2.1, and 26.2 in 26.2.1. Versions earlier than 20.9 have no fix and must be migrated to a supported release. Cisco strongly recommends upgrading to a fixed release to remediate the vulnerability. Admins planning SD-WAN patch cycles can follow version-specific fixes like these via daily.dev."}},{"@type":"Question","name":"How can I tell if my Cisco SD-WAN Manager was compromised by the CVE-2026-76504 exploit?","acceptedAnswer":{"@type":"Answer","text":"Check the serviceproxy-access.log file under /var/log/nms/containers/service-proxy and the vmanage-server.log file under /var/log/nms/ for j_security_check entries from unknown or unauthorized IP addresses. Attackers use %6a, the URI-encoded character for 'j', in malicious requests. Cisco TAC can assist further after admins collect admin-tech files for review. Incident responders investigating SD-WAN compromises can find fresh IOC reports like this on daily.dev."}}]}
```