Cisco SD-WAN vManage Authentication Bypass Zero-Day

On September 30, 2026, Cisco disclosed CVE-2026-76504, a critical authentication bypass vulnerability in the SD-WAN vManage product line. This vulnerability was reportedly exploited as a zero-day in the wild. By sending a single crafted POST request, attackers can bypass credential verification and obtain a valid administrative session, potentially compromising the entire SD-WAN infrastructure.

The flaw stems from a discrepancy in how different software components handle URL encoding. The WildFly application server decodes the request path to evaluate security constraints, while the custom Cisco AppServerLoginModule uses the raw, undecoded URI to decide whether to trigger a password check. This allows attackers to bypass the login logic and fall back to internal authentication paths that only require knowledge of specific reserved internal usernames.

Approximately 1,500 vManage devices are currently exposed to the internet. Successful exploitation provides full administrative access to the SD-WAN management console, allowing for configuration changes, traffic interception, or further lateral movement within the network.