Cisco SD-WAN Manager CVE-2026-76504 Zero-Day Shows Active Exploitation via URI Bypass in Login API

The flaw resides in the session login handler where a single URI-encoded character bypasses an access restriction, letting attackers invoke admin-level operations without credentials. Cisco's PSIRT learned of the issue through a TAC support case and stated exploitation began in September 2026. Affected on-prem deployments require upgrades to specific releases such as 20.9.10.1 or 20.18.4.1; earlier fixes for CVE-2026-20182, CVE-2026-20245, and CVE-2026-20262 do not cover this vector. Log analysis focuses on serviceproxy-access.log and vmanage-server.log entries showing encoded paths paired with viptela-reserved- accounts.

Cisco omitted several release trains listed in prior advisories and did not reference SD-WAN Cloud-Pro or FedRAMP instances, creating an incomplete patch map. The advisory provides no victim counts, attacker infrastructure, or post-compromise actions, limiting independent verification. This pattern matches earlier SD-WAN disclosures where management-plane exposure persisted despite hardening guidance recommending jump-host access only for ports 443, 22, and 830.

Operators should treat every exposed Manager as compromised until patched and reviewed. The absence of a workaround and the default netadmin role amplify blast radius. Next steps include immediate log triage for anomalous j_security_check requests, firewall rules restricting Manager access to trusted management subnets, and confirmation that Cloud Hosted environments inherited the 20.15.605 fix.