CVE-2026-76504
CISA KEV
ACT NOW
Priority: 0.00
BB Relevance:
8/100
Published: N/A
Modified: N/A
First seen: 2026-10-29
Status: pending_score
Description
Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.
CISA Known Exploited Vulnerability
Vendor / Product
Cisco — Catalyst SD-WAN Manager
Date Added
2026-09-30
Remediation Due
2026-10-03
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-76504
Weakness Classification (1)
Affected Software (6)
| Vendor | Product | Version |
|---|---|---|
| cisco | catalyst_sd-wan_manager | < 20.9.10.1 |
| cisco | catalyst_sd-wan_manager | 20.12 – 20.12.8.2 |
| cisco | catalyst_sd-wan_manager | 20.15 – 20.15.6.1 |
| cisco | catalyst_sd-wan_manager | 20.18 – 20.18.4.1 |
| cisco | catalyst_sd-wan_manager | 26.1 – 26.1.2.1 |
| cisco | catalyst_sd-wan_manager | 26.2 |
References & Advisories (2)
US Government Resource
Mitigation
Vendor Advisory