Cisco patches actively exploited SD-WAN authentication bypass

Cisco released fixes for CVE-2026-76504, a critical flaw in Catalyst SD-WAN Manager that the company says attackers are actively exploiting. The vulnerability lets unauthenticated attackers gain remote administrator access and affects all deployments regardless of configuration. A crafted HTTP request can exploit improper handling of encoded characters to bypass an authentication rule protecting an API endpoint. The software lets administrators manage up to 6,000 SD-WAN devices from one dashboard. Cisco recommends upgrading to a fixed release and checking logs for suspicious requests involving j_security_check; it did not disclose further details of the attacks.