CVE entry · CVE-2026-76504
CVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.
- Actively exploited: added to CISA’s KEV catalog on September 30, 2026.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: October 3, 2026.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes Cisco Catalyst SD-WAN Manager, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
- Vendor advisory or reference cited by CISA (sec.cloudapps.cisco.com)
- NVD entry (NIST)
- CISA KEV catalog
Other Cisco vulnerabilities
-
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
-
Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
-
Cisco Secure Email Gateway SQL Injection Vulnerability
-
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
-
Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability
-
CVE-2026-20316Used by ransomwareCisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability