CVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.
Overview
Cisco Catalyst SD-WAN Manager contains an authentication bypass flaw in its API layer caused by improper normalization of percent-encoded characters in HTTP request URIs. An unauthenticated remote attacker who can reach the management API can send a crafted POST request with a hex-encoded path that evades the authentication filter while the backend processes it normally, gaining full admin-level access to the system. Specific discrete versions across the 18.x, 19.x, and 20.x release lines are affected, regardless of system configuration.
Vulnerability details
The flaw is classified as CWE-177, improper handling of URL encoding. Cisco Catalyst SD-WAN Manager evaluates authentication rules against the raw URI string before normalizing percent-encoded characters. When a protected endpoint path contains even a single percent-encoded character, the authentication filter does not match it against the restricted path pattern, so the request passes through without credential validation. The backend application then decodes the URI and routes the request to the intended endpoint as if it were authenticated, producing a complete authentication bypass at the API layer.
An attacker with network access to the SD-WAN Manager API sends a crafted HTTP POST request to a URI such as /%6a_security_check, where %6a is the hex encoding of the letter j. The authentication rule intended to protect the j_security_check endpoint does not fire, but the backend processes the request and grants access with admin user privileges. No credentials, prior session, or user interaction are required. Systems with the management API exposed to the internet face the highest risk, as exploitation requires only the ability to send an HTTP request to the API port.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Audit the serviceproxy-access.log file at /var/log/nms/containers/service-proxy/serviceproxy-access.log for POST requests to paths matching /%[0-9a-fA-F]{2}_security_check returning HTTP 200, particularly from IP addresses not in the authorized management range.
- Audit the vmanage-server.log file at /var/log/nms/vmanage-server.log for j_security_check entries associated with usernames beginning with viptela-reserved- that have no corresponding legitimate admin session or known service operation.
Remediation
Additional hardening
- Upgrade affected Cisco Catalyst SD-WAN Manager instances. The affected discrete versions span the 18.4.x, 19.2.x, 19.3.x, and 20.1.x release lines; consult the vendor advisory listed in References for the first fixed release in each line.
- Restrict network access to the SD-WAN Manager API to known, authorized management IP ranges. Systems with the API port exposed to the internet are at highest risk and should be isolated behind a firewall or access control list immediately.
- Apply Cisco's Live Protect shield as a temporary partial measure while upgrade scheduling is underway, noting the vendor's documented side effect that users with URI-encoded credentials may be unable to log in while the shield is active.
- Run the request admin-tech command on the vManage instance and review the resulting file for indicators of compromise before patching, preserving forensic state in case the system was accessed prior to remediation.
Key dates
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-76504
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76504
Frequently asked questions
Does CVE-2026-76504 affect my FedRAMP authorization?
If Cisco Catalyst SD-WAN Manager runs inside your authorization boundary, yes. CVE-2026-76504 appears on CISA's Known Exploited Vulnerabilities (KEV) catalog, and its remediation deadline of October 3, 2026 has already passed. An unpatched KEV inside a FedRAMP authorization boundary is an assessor finding. An overdue one is visible to both your assessor and your sponsoring agency. At this point, you either remediate it or formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-76504?
Knox does not patch your software. Remediating Cisco Catalyst SD-WAN Manager is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus Knox's automated continuous monitoring platform and audit-artifact coverage to document the fix for your next assessment. Applying the patch is yours to own; managing your compliance posture while you do it is not something you handle alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on an ongoing basis. For a CVE like CVE-2026-76504, that means exposure surfaces during continuous monitoring rather than only when an assessor flags it at review time, giving your team earlier visibility into what needs to be addressed.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-76504's remediation deadline of October 3, 2026 has passed. What happens now?
If CVE-2026-76504 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing out the vulnerability now and documenting why the deadline was missed is what keeps your authorization clean and the agency relationship intact.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
