{"uuid": "cd50c82d-7836-44f9-9083-a3ed903f8ef2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76504", "type": "seen", "source": "https://gist.github.com/alon710/516173c41df42470cfdef2c71513bc87", "content": "# CVE-2026-76504: CVE-2026-76504: Unauthenticated Authentication Bypass in Cisco Catalyst SD-WAN Manager\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-09-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-76504\n\n## Summary\nCVE-2026-76504 is a critical vulnerability in the web-based management console of Cisco Catalyst SD-WAN Manager. Due to improper normalization and handling of hex/percent-encoded sequences (CWE-177) within incoming request URIs, remote, unauthenticated attackers can bypass administrative authentication controls. Successful exploitation permits full remote administrative command execution on the SD-WAN management plane, threatening the integrity and availability of the managed network fabric.\n\n## TL;DR\nAn unauthenticated remote authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager allows attackers to perform administrative actions with root-level privileges by exploiting inconsistency in URI hex/percent-encoding handling across web application layers.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-177 (Improper Handling of URL Encoding)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 9.8\n- **Exploit Status**: active\n- **CISA KEV Listed**: Yes (Added September 30, 2026)\n- **Impact**: Complete administrative compromise of SD-WAN management interface\n\n## Affected Systems\n\n- Cisco Catalyst SD-WAN Manager (formerly vManage)\n- **Catalyst SD-WAN Manager**: < 20.9.10.1 (Fixed in: `20.9.10.1`)\n- **Catalyst SD-WAN Manager**: >= 20.12.0.0, < 20.12.8.2 (Fixed in: `20.12.8.2`)\n- **Catalyst SD-WAN Manager**: >= 20.15.0.0, < 20.15.6.1 (Fixed in: `20.15.6.1`)\n- **Catalyst SD-WAN Manager**: >= 20.18.0.0, < 20.18.4.1 (Fixed in: `20.18.4.1`)\n- **Catalyst SD-WAN Manager**: >= 26.1.0.0, < 26.1.2.1 (Fixed in: `26.1.2.1`)\n- **Catalyst SD-WAN Manager**: >= 26.2.0.0, < 26.2.1 (Fixed in: `26.2.1`)\n\n## Mitigation\n\n- De-expose Cisco Catalyst SD-WAN Manager management interfaces from the public internet.\n- Implement restrictive local network and firewall Access Control Lists (ACLs) to allow traffic only from designated, trusted administrative hosts.\n- Enforce authentication protocols at the network perimeter, such as requiring VPN or Multi-Factor authenticated jump servers to access administrative zones.\n\n**Remediation Steps:**\n1. Identify the current software generation of all deployed Catalyst SD-WAN Manager instances.\n2. Cross-reference the running version against the fixed release matrix to determine the correct target firmware path.\n3. Schedule emergency maintenance windows to deploy the updated software versions.\n4. Verify that the web interface is inaccessible via paths containing double-escaped or percent-encoded traversal indicators.\n\n## References\n\n- [Cisco Security Advisory: Cisco Catalyst SD-WAN Manager Authentication Bypass Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU)\n- [CISA KEV Catalog Reference for CVE-2026-76504](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76504)\n- [CVE-2026-76504 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-76504)\n- [NVD Vulnerability Details for CVE-2026-76504](https://nvd.nist.gov/vuln/detail/CVE-2026-76504)\n- [ShadowForge Cyber Exploit Verification Repository](https://github.com/ShadowForge-Cyber/CVE-2026-76504-Proof-of-concept)\n- [ShadowForge Cyber Vulnerability Verification Documentation](https://raw.githubusercontent.com/ShadowForge-Cyber/CVE-2026-76504-Proof-of-concept/main/README.md)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-76504) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-01T17:30:31.000000Z"}