CVE-2026-76504— Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability
Quick assessment
Affected
Cisco Cisco Catalyst SD-WAN Manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cisco Catalyst SD-WAN Manager 中基于 API 会话的身份验证管理存在一个漏洞，可能允许未经身份验证的远程攻击者以管理员用户权限访问受影响的系统。 该漏洞源于对 HTTP 请求中 URI 编码的处理不当，导致攻击者能够绕过旨在限制特定 API 端点访问的身份验证规则。攻击者可通过向受影响系统的 API 发送精心构造的 HTTP 请求来利用此漏洞。成功利用后，攻击者可绕过身份验证机制，并以管理员用户身份访问该 API。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1556.001 · Domain Controller Authentication
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76504
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.
This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
URL编码处理不恰当(Hex编码)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco Catalyst SD-WAN Manager | 18.3.6 | - |
|
II. Public POCs for CVE-2026-76504
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76504
请登录查看更多情报信息。
Other References for CVE-2026-76504 (1)
IV. Related Vulnerabilities
Same product: Cisco Catalyst SD-WAN Manager
-
CVE-2026-20294
Cisco Catalyst SD-WAN Manager Information Disclosure Vulnera -
CVE-2026-20262
Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerabi -
CVE-2026-20224
Cisco Catalyst SD-WAN Manager XML External Entity Injection -
CVE-2026-20210
Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerabi -
CVE-2026-20209
Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerabi
Same vendor: Cisco
-
CVE-2026-76426
Cisco ISE REST API SQL Injection Vulnerability -
CVE-2026-20121
CIsco FTD Bypass Access List -
CVE-2026-76431
Cisco Identity Services Engine Arbitrary File Deletion Vulne -
CVE-2026-76427
Cisco ISE XML External Entity Injection Vulnerability -
CVE-2026-76447
Cisco Identity Services Engine Certificate Reload Vulnerabil
Same weakness: CWE-177
-
CVE-2026-96748
Connection redirection via percent-encoded delimiter injecti -
CVE-2026-76172
fast-uri vulnerable to host confusion via percent-encoded sc -
CVE-2026-67448
Mailpit: WebSocket origin check bypass via percent-encoded p -
CVE-2026-15371
Velociraptor Stored XSS in URL column types -
CVE-2026-59083
Apache Tomcat: Incorrect URL decoding in RewriteValve may al
V. Comments for CVE-2026-76504
No comments yet