CVE-2026-76504 actively exploited: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
CISA added CVE-2026-76504, affecting Cisco Catalyst SD-WAN Manager, to its Known Exploited Vulnerabilities catalogue. It could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. Federal agencies must remediate by October 3, 2026.
Cisco disclosed a flaw in Catalyst SD-WAN Manager where improper handling of URI encoding enables exploitation. An unauthenticated remote attacker could use this hex encoding issue to gain admin privileges. The system fails to correctly process HTTP requests, creating a critical security gap. CISA designated this issue for the Added to CISA Known Exploited Vulnerabilities directory. Owners of Cisco Catalyst SD-WAN Manager face direct risk from this specific defect. The threat targets devices with active internet exposure where the bug remains unresolved. Stakeholders must evaluate each asset to determine if the product is in use. Uncertainty exists regarding specific ransomware campaign involvement, as current data marks this usage as unknown. Administrators must apply mitigations per vendor instructions to close the security hole. Compliance with BOD 26-04 requires prioritizing updates based on risk levels. Cloud services must follow distinct BOD 26-04 guidance or discontinue product use if fixes are unavailable. Federal agencies hold a deadline of October 3, 2026, for full remediation. Staff should also meet CISA forensics triage requirements during response.