CVE-2026-76504 · Low · CISA KEV

Cisco SD-WAN Manager Hex Encoding Flaw Allows Unauthenticated Admin Access

Threat Engine Auto-Feed · data current as of 2026-09-30

A hex encoding vulnerability in Cisco Catalyst SD-WAN Manager allows an unauthenticated, remote attacker to gain administrative access. This vulnerability is listed in CISA KEV, indicating active exploitation in the wild. Organizations using affected Cisco SD-WAN Manager instances are at high risk.

  • CVSS:
  • EPSS percentile:
  • Exploitation pressure: 25/100 (Low)

Exploitation reality: listed in CISA KEV (exploited in the wild). Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability stems from improper handling of URI encoding in HTTP requests. Specifically, the system fails to correctly process hex-encoded characters, which an attacker can leverage to bypass authentication and gain unauthorized access with administrative privileges.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations utilizing Cisco Catalyst SD-WAN Manager
  • Financial services organizations (targeted by FIN7, LockBit affiliates, APT38)
  • Technology sector organizations (targeted by APT29, Scattered Spider)

Misconfigurations that escalate it

  • Any configuration that exposes Cisco Catalyst SD-WAN Manager to untrusted networks or the internet without proper protective measures.

High-impact scenarios

  • Complete compromise of SD-WAN management infrastructure, leading to potential network disruption or unauthorized access to connected resources.
  • Attacker gaining full administrative control over the SD-WAN environment, enabling configuration changes, traffic redirection, or further lateral movement.
  • Data exfiltration or espionage if the SD-WAN manager provides access to sensitive network information or control planes.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor Cisco Catalyst SD-WAN Manager logs for unusual or unauthorized administrative access attempts.
  • Look for HTTP requests containing unusual or malformed URI encoding patterns targeting the SD-WAN Manager interface.
  • Implement network intrusion detection systems (NIDS) to identify suspicious traffic patterns directed at SD-WAN management interfaces.

Contain

  • Isolate affected Cisco Catalyst SD-WAN Manager instances from untrusted networks.
  • Implement strict network segmentation to limit the blast radius if an SD-WAN Manager is compromised.
  • Review and revoke any potentially compromised administrative credentials immediately.

Patch

  • Apply the latest security updates and patches released by Cisco for Catalyst SD-WAN Manager as soon as they become available.

Frontier verdict — Low

This is a critical vulnerability due to unauthenticated remote admin access and confirmed in-the-wild exploitation, requiring immediate attention.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.