Cisco released security updates addressing an actively exploited zero-day vulnerability in Cisco Catalyst SD-WAN Manager (formerly vManage), tracked as CVE-2026-76504 with a CVSS score of 9.8. The critical flaw resides in the API session-based authentication subsystem due to improper handling of URI encoding (CWE-177). Remote, unauthenticated adversaries can transmit crafted HTTP requests utilizing percent-encoded characters—specifically %6a in place of the ASCII letter j during POST /%6a_security_check requests—to evade reverse proxy routing filters, bypass endpoint authentication checks, and acquire full administrative privileges on the appliance.

Cisco PSIRT confirmed active in-the-wild exploitation, marking the fifth Cisco SD-WAN zero-day targeted by adversaries this year. Compromise yields unconstrained administrative control over the SD-WAN fabric, exposing WAN routing topologies, orchestration policies, and downstream edge routers. Cisco confirmed that no workarounds exist, mandating immediate upgrades across impacted 20.x and 26.x software trains. Defenders should audit serviceproxy-access.log and vmanage-server.log for unauthorized URI-encoded j_security_check requests and anomalous actions tied to viptela-reserved- identity strings.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Trivial URI canonicalization mismatches completely bypass perimeter reverse proxy authentication gates, enabling remote unauthenticated attackers to acquire administrative control over the SD-WAN control plane and poison enterprise-wide network routing.
• Bullet 2 — Strategic & Defender Imperative: With no viable workarounds and confirmed exploitation in the wild, organizations must immediately apply fixed firmware, isolate Catalyst SD-WAN management interfaces from public routing, and audit proxy logs for encoded authentication sequences.