Patch Cisco Catalyst SD-WAN Manager: an exploited login bypass with no workaround

If you run Cisco Catalyst SD-WAN Manager (the management console for a Cisco SD-WAN, formerly called vManage), upgrade it now. A flaw in its API login handling lets a remote, unauthenticated attacker get in with administrator privileges. Cisco says it learned of active exploitation in September 2026, and CISA added the flaw to the Known Exploited Vulnerabilities (KEV) catalog on September 30, 2026.

Most small offices don’t run this product. It matters if you’re an MSP or the IT person for a multi-site organization with a Cisco SD-WAN, because the Manager controls the routers at every site.

The details

• CVE: CVE-2026-76504
• Severity: CVSS 9.8, critical. No login or user interaction is needed.
• Affected: all configurations of Catalyst SD-WAN Manager on the release trains below.
• Exploitation: confirmed by Cisco’s advisory and by CISA’s KEV listing.
• CISA due date: October 3, 2026 for federal agencies. If you serve government or a bank, treat that as your own target.
• Workaround: none. Cisco’s only interim advice is to restrict internet access to the Manager and keep it behind a firewall.

Fixed releases

Release train	Fixed version
20.9 and earlier	20.9.10.1
20.12	20.12.8.2
20.15	20.15.6.1
20.18	20.18.4.1
26.1	26.1.2.1
26.2	26.2.1
Cisco-hosted cloud	20.15.605

Cisco’s advisory says to use the Help function in the Manager’s web interface to see your current version and remediation status. Take a backup or snapshot before upgrading, as you would for any controller.

Blocking internet access reduces exposure but doesn’t fix the flaw. Anyone who can reach the Manager’s web interface can try the bypass, so treat the upgrade as urgent.

Check whether you were already hit

Because exploitation began before the advisory, patching isn’t the end of the job. Cisco’s advisory says to audit two Manager logs for requests to the login endpoint (j_security_check) written in URL-encoded form, from IP addresses you don’t recognize or involving system accounts whose names begin with viptela-reserved-:

• /var/log/nms/containers/service-proxy/serviceproxy-access.log
• /var/log/nms/vmanage-server.log

Also review the list of administrator accounts and any recent configuration changes you didn’t make. If you find a match, or can’t rule it out, restrict access to the Manager, preserve the logs, and bring in your incident response contact. Our first-hour guide covers the basics.

Cisco’s firewall management console also had an exploited authentication bypass recently: see the FMC advisory.

Sources

• Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability (Cisco): CVSS, affected and fixed releases, no workaround, exploitation statement, log guidance
• Known Exploited Vulnerabilities catalog (CISA): CVE-2026-76504 added September 30, 2026, due date October 3