Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)

Rapid7 BlogSeptember 30, 2026AppSec Vulnerabilities Identity

MentionsCisco

Overview On September 30, 2026, Cisco published a security advisory for CVE-2026-76504 , a critical API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager. The vulnerability has a CVSSv3.1 score of 9.8 and results from improper handling of URL encoding ( CWE-177 ).

Summary from Rapid7 Blog.

Read the full article at Rapid7 Blog

Vulnerabilities in this story

Severity and exploitation facts from NVD, FIRST, and CISA.

CVE-2026-76504Critical 9.8Known exploitedEPSS 1.8%

Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)

Vulnerabilities in this story

More in AppSec

PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

SANS Stormcast Wednesday, October 21st, 2026: eMudhra Intermediate CA Certificates Revoked; Critical PHP Security Release; Oracle CPU E-Business Suite SQLi (CVE-2026-101767); FortiSIEM gRPC RCE PoC

Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution

AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign

SANS Stormcast Tuesday, October 20th, 2026: Plex2Shell RCE Exploited; Broadcom eCos Wi-Fi RCE; OVHcloud CLI Compromised; Exchange Issues After October Updates; AI Agent Containment; VBA in DWG YARA