/
← Voltar ao feed
critical

Cisco Catalyst SD-WAN Manager API authentication bypass (CVE-2026-76504) gives unauthenticated attackers admin access

1 fonte(s) · 1 atualização(ões) · publicado 02/10/2026 20:18 · coletado há 1 dia

Baseado só no resumo do feed. O site da fonte não liberou o texto completo para o Tifon, então esta análise saiu apenas do resumo publicado no feed e pode estar incompleta. Ela é atualizada quando outra fonte cobrir o assunto. Ler na fonte original ↗

Cisco disclosed a critical authentication bypass, CVE-2026-76504, in the API session-based authentication management of Cisco Catalyst SD-WAN Manager. An unauthenticated, remote attacker can send a crafted HTTP request and gain access to the API with the privileges of the admin user. Cisco has released software updates and states that no workarounds exist. The advisory does not mention active exploitation. Because the flaw requires no authentication and grants admin API access, affected deployments should be patched urgently.

Technical Details

  • The root cause is improper handling of URI encoding in an HTTP request. This lets the request bypass an authentication rule meant to restrict access to a specific API endpoint.
  • Exploitation requires only a crafted HTTP request to the API of the affected system.
  • Cisco rates the Security Impact as Critical.
  • Cisco also released a Live Protect shield for CVE-2026-76504. It gives only temporary, partial protection. Side effect: a legitimate user with URI encoding might be unable to log in to SD-WAN Manager.

Remediation

  • Upgrade to the first fixed software release listed in the Fixed Releases section of the Cisco advisory. This is the only way to fully remediate the vulnerability.
  • If the upgrade cannot happen immediately, apply the Live Protect shield as a stopgap and weigh its login side effect. It does not replace the upgrade.
  • Cisco strongly recommends prioritizing and scheduling upgrades as soon as possible.

Linha do tempo

  1. sec.cloudapps.cisco.com ↗ · pub. 02/10/2026 20:18 · coletado 19/10 18:02 primeiro registro só resumo do feed

    Cisco Catalyst SD-WAN Manager API authentication bypass (CVE-2026-76504) gives unauthenticated attackers admin access

    ler a análise desta fonte

    Cisco disclosed a critical authentication bypass, CVE-2026-76504, in the API session-based authentication management of Cisco Catalyst SD-WAN Manager. An unauthenticated, remote attacker can send a crafted HTTP request and gain access to the API with the privileges of the admin user. Cisco has released software updates and states that no workarounds exist. The advisory does not mention active exploitation. Because the flaw requires no authentication and grants admin API access, affected deployments should be patched urgently.

    Technical Details

    • The root cause is improper handling of URI encoding in an HTTP request. This lets the request bypass an authentication rule meant to restrict access to a specific API endpoint.
    • Exploitation requires only a crafted HTTP request to the API of the affected system.
    • Cisco rates the Security Impact as Critical.
    • Cisco also released a Live Protect shield for CVE-2026-76504. It gives only temporary, partial protection. Side effect: a legitimate user with URI encoding might be unable to log in to SD-WAN Manager.

    Remediation

    • Upgrade to the first fixed software release listed in the Fixed Releases section of the Cisco advisory. This is the only way to fully remediate the vulnerability.
    • If the upgrade cannot happen immediately, apply the Live Protect shield as a stopgap and weigh its login side effect. It does not replace the upgrade.
    • Cisco strongly recommends prioritizing and scheduling upgrades as soon as possible.