FlagThis — Daily Cybersecurity Intelligence Briefing

Cisco PSIRT has disclosed CVE-2026-76504, a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager (vManage) affecting multiple release branches. The flaw arises from improper handling of URL-encoded characters within the j_security_check API endpoint, allowing unauthenticated remote attackers to bypass security controls using crafted requests, such as POST /%6a_security_check. Active exploitation has been confirmed in the wild, prompting immediate inclusion in the CISA Known Exploited Vulnerabilities catalog. Successful exploitation grants full administrative control over the SD-WAN control plane, enabling lateral movement and potential compromise of the entire managed network infrastructure. Immediate patching is required as no software workarounds are available.

In early 2026, attackers leveraged rogue peering to gain SSH access to a Cisco Catalyst SD-WAN Manager using the default vmanage-admin account, then exploited CVE-2026-20245—a local privilege‑escalation flaw in the SD‑WAN Manager CLI—to upload a malicious CSV file (evil_tenant.csv) that added a hidden troot account to /etc/passwd and /etc/shadow, achieving root. The incident, observed by Mandiant and Google GTIG, resulted in management‑plane compromise, configuration exfiltration, and anti‑forensic cleanup, highlighting SD‑WAN controllers as high‑value targets for persistent privileged access.