Security1 hOctober 19, 2026, 16:00

Cisco patches critical SD-WAN Manager auth bypass under active exploit

Cisco disclosed CVE-2026-76504, a CVSS 9.8 authentication bypass in Catalyst SD-WAN Manager (formerly vManage) caused by improper URI-encoding handling. The flaw is being actively exploited and has no workaround; only an upgrade closes it.

DEV Community

Open source

Cisco patches critical SD-WAN Manager auth bypass under active exploit

CVSS 9.8: unauthenticated bypass requiring no user interaction
Flaw stems from mishandled URI encoding in the session-login API
Cisco confirmed active exploitation in September 2026
Hunt logs for /%6a_security_check paths and viptela-reserved- accounts

#Cisco#SD-WAN

Three Artifactory flaws under active exploitation allow auth bypass and admin access

Security

Cisco FMC CVE-2026-20079 exploited: auth bypass with CVSS 10.0

Security

Active exploitation attempts target WSO2 API Manager JWT bypass

Security

Cisco patches critical SD-WAN Manager auth bypass under active exploit

Three Artifactory flaws under active exploitation allow auth bypass and admin access

Cisco FMC CVE-2026-20079 exploited: auth bypass with CVSS 10.0

Active exploitation attempts target WSO2 API Manager JWT bypass

PaperCut flaws enable pre-auth RCE, active exploitation reported