Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager

Cisco disclosed active exploitation of CVE-2026-76504, a critical (CVSS 9.8) authentication bypass in Catalyst SD-WAN Manager that lets unauthenticated attackers gain built-in admin (netadmin) API sessions by percent-encoding a character in the j_security_check path; Cisco released emergency fixes for all affected trains, CISA added the flaw to its KEV catalog, and defenders are urged to patch immediately and hunt logs for percent-encoded j_security_check requests and viptela-reserved- account activity.