Cisco SD-WAN Manager hit by zero-day admin access attack

Cisco has patched a critical zero-day vulnerability, CVE-2026-76504, affecting Cisco Catalyst SD-WAN Manager. The flaw stemmed from improper handling of URI encoding in HTTP requests, allowing attackers to bypass authentication controls for a specific API endpoint. Successful exploitation grants unauthorized admin privileges, potentially compromising the wider SD-WAN environment. With a CVSS score of 9.8, Cisco PSIRT confirmed active exploitation of this flaw. The company has released a fix to prevent unauthorized access to the management platform.