Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability

Cisco Catalyst SD-WAN Manager faces a critical authentication bypass vulnerability, CVE-2026-76504, with a CVSS score of 9.8. By using hex-encoded characters in URI requests, unauthenticated remote attackers can bypass security rules to gain admin privileges. This flaw allows attackers to manipulate network fabric configurations, intercept traffic, and move laterally across infrastructure. Cisco has released software updates to address this issue, which is currently being actively exploited due to improper URI encoding handling.