Vulnerability-Lookup

CERTFR-2026-AVI-1246

Vulnerability from certfr_avis - Published: 2026-10-01 - Updated: 2026-10-01

Une vulnérabilité a été découverte dans Cisco Catalyst SD-WAN. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.

Cisco indique que la vulnérabilité CVE-2026-76504 est activement exploitée.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Cisco	Catalyst SD-WAN	Catalyst SD-WAN Software versions postérieures à Earlier than 20.9 et antérieures à 20.9.10.1
Cisco	Catalyst SD-WAN	Catalyst SD-WAN Software versions 20.12.x antérieures à 20.12.8.2
Cisco	Catalyst SD-WAN	Catalyst SD-WAN Software versions 26.2.x antérieures à 26.2.1
Cisco	Catalyst SD-WAN	Catalyst SD-WAN Software versions 26.1.x antérieures à 26.1.2.1
Cisco	Catalyst SD-WAN	Catalyst SD-WAN Software versions 20.18.x antérieures à 20.18.4.1
Cisco	Catalyst SD-WAN	Catalyst SD-WAN Software versions 20.15.x antérieures à 20.15.6.1

References

Title

Publication Time

Tags

Bulletin de sécurité Cisco cisco-sa-sdwan-webauth-xr8beuuU

2026-09-30

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Catalyst SD-WAN Software versions post\u00e9rieures \u00e0 Earlier than 20.9 et ant\u00e9rieures \u00e0 20.9.10.1",
      "product": {
        "name": "Catalyst SD-WAN",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Catalyst SD-WAN Software versions 20.12.x ant\u00e9rieures \u00e0 20.12.8.2",
      "product": {
        "name": "Catalyst SD-WAN",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Catalyst SD-WAN Software versions 26.2.x ant\u00e9rieures \u00e0 26.2.1",
      "product": {
        "name": "Catalyst SD-WAN",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Catalyst SD-WAN Software versions 26.1.x ant\u00e9rieures \u00e0 26.1.2.1",
      "product": {
        "name": "Catalyst SD-WAN",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Catalyst SD-WAN Software versions 20.18.x ant\u00e9rieures \u00e0 20.18.4.1",
      "product": {
        "name": "Catalyst SD-WAN",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Catalyst SD-WAN Software versions 20.15.x ant\u00e9rieures \u00e0 20.15.6.1",
      "product": {
        "name": "Catalyst SD-WAN",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-76504",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76504"
    }
  ],
  "initial_release_date": "2026-10-01T00:00:00",
  "last_revision_date": "2026-10-01T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1246",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-10-01T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Cisco Catalyst SD-WAN. Elle permet \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.\n\nCisco indique que la vuln\u00e9rabilit\u00e9 CVE-2026-76504 est activement exploit\u00e9e.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Cisco Catalyst SD-WAN",
  "vendor_advisories": [
    {
      "published_at": "2026-09-30",
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sdwan-webauth-xr8beuuU",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU"
    }
  ]
}

CVE-2026-76504 (GCVE-0-2026-76504)

Vulnerability from cvelistv5 – Published: 2026-09-30 13:04 – Updated: 2026-10-01 03:55

Title

Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability

Summary

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: active Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 00:00 UTC

CWE

CWE-177 - Improper Handling of URL Encoding (Hex Encoding)

Assigner

cisco mitre root Scorecard

References

2 references

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

1 product

Vendor	Product	Version
Cisco	Cisco Catalyst SD-WAN Manager	Affected: 18.3.6 Affected: 18.3.7 Affected: 18.3.8 Affected: 17.2.10 Affected: 18.3.6.1 Affected: 18.2.0 Affected: 18.4.3 Affected: 18.4.1 Affected: 17.2.8 Affected: 18.3.3.1 Affected: 18.4.0 Affected: 18.3.1 Affected: 17.2.6 Affected: 17.2.9 Affected: 18.3.4 Affected: 17.2.5 Affected: 18.3.1.1 Affected: 18.3.5 Affected: 18.4.0.1 Affected: 18.3.3 Affected: 17.2.7 Affected: 17.2.4 Affected: 18.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76504",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-09-30",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76504"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-01T03:55:35.195Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76504"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-09-30T00:00:00.000Z",
            "value": "CVE-2026-76504 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Catalyst SD-WAN Manager",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "18.3.6"
            },
            {
              "status": "affected",
              "version": "18.3.7"
            },
            {
              "status": "affected",
              "version": "18.3.8"
            },
            {
              "status": "affected",
              "version": "17.2.10"
            },
            {
              "status": "affected",
              "version": "18.3.6.1"
            },
            {
              "status": "affected",
              "version": "18.2.0"
            },
            {
              "status": "affected",
              "version": "18.4.3"
            },
            {
              "status": "affected",
              "version": "18.4.1"
            },
            {
              "status": "affected",
              "version": "17.2.8"
            },
            {
              "status": "affected",
              "version": "18.3.3.1"
            },
            {
              "status": "affected",
              "version": "18.4.0"
            },
            {
              "status": "affected",
              "version": "18.3.1"
            },
            {
              "status": "affected",
              "version": "17.2.6"
            },
            {
              "status": "affected",
              "version": "17.2.9"
            },
            {
              "status": "affected",
              "version": "18.3.4"
            },
            {
              "status": "affected",
              "version": "17.2.5"
            },
            {
              "status": "affected",
              "version": "18.3.1.1"
            },
            {
              "status": "affected",
              "version": "18.3.5"
            },
            {
              "status": "affected",
              "version": "18.4.0.1"
            },
            {
              "status": "affected",
              "version": "18.3.3"
            },
            {
              "status": "affected",
              "version": "17.2.7"
            },
            {
              "status": "affected",
              "version": "17.2.4"
            },
            {
              "status": "affected",
              "version": "18.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.\r\n\r\nThis vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-177",
              "description": "Improper Handling of URL Encoding (Hex Encoding)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T13:04:32.095Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-sdwan-webauth-xr8beuuU",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU"
        }
      ],
      "source": {
        "advisory": "cisco-sa-sdwan-webauth-xr8beuuU",
        "defects": [
          "CSCww79570"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-76504",
    "datePublished": "2026-09-30T13:04:32.095Z",
    "dateReserved": "2026-08-19T12:02:03.641Z",
    "dateUpdated": "2026-10-01T03:55:35.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted