Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability

**Executive Summary:** Cisco disclosed CVE-2026-76504, a critical authentication bypass in the Cisco Catalyst SD-WAN Manager API that permits unauthenticated remote attackers to obtain administrator-level access by sending crafted HTTP requests with URI-encoded characters (for example, encoding the 'j' in j_security_check as %6a). Cisco reports active exploitation (September 2026), provides indicators of compromise (encoded j_security_check requests and viptela-reserved- account log entries), lists affected/fixed releases, notes there is no workaround, and recommends upgrading to fixed releases and restricting access to the API.