CVE-2026-76504: Unauthenticated Authentication Bypass in Cisco Catalyst SD-WAN Manager

Cisco Catalyst SD-WAN Manager (formerly vManage) serves as the centralized management and orchestration plane for SD-WAN architectures. It is responsible for provisioning, configuring, and monitoring WAN Edge routers and overall overlay topology. This central role exposes a significant web interface attack surface, which hosts administrative REST APIs for deep orchestration and troubleshooting tasks.

The vulnerability, tracked as CVE-2026-76504, lies in the authentication and authorization middleware responsible for verifying request credentials. By crafting specific request paths containing hex-encoded sequences, an unauthenticated attacker can manipulate the path-routing logic. This causes the security filter to identify a restricted administrative API endpoint as a publicly accessible, non-authenticated resource.

The impact is rated with the maximum CVSSv3.1 score of 9.8 (Critical). Successful exploitation yields complete control of the administrative console. Because the SD-WAN Manager orchestrates the enterprise-wide network topology, compromising this system allows attackers to intercept, redirect, or disrupt transit traffic across the entire enterprise WAN overlay.

The fundamental flaw driving CVE-2026-76504 is a parser differential vulnerability falling under CWE-177: Improper Handling of URL Encoding. The issue arises from mismatched URI parsing logic between the front-end authentication routing filter and the back-end application controller servlet engine.

In standard operation, the authentication filter intercepts incoming HTTP requests and matches the requested path against an access control list (ACL). This ACL defines public endpoints (e.g., login pages or public asset directories) and protected resources (such as /dataservice/ paths). When analyzing the incoming path, the filter checks the string in its raw or partially decoded state. It fails to normalize hex-encoded characters (like %2f for slashes, %252f for double-encoded slashes, or relative path traversal sequences like %2e%2e%2f). Consequently, the filter evaluates a URI containing these encoded values literally and fails to match it against any protected path patterns. This leads the filter to conclude the request is aimed at a public endpoint and waive authentication requirements.

Following the authentication check, the request is forwarded to the backend API router. This component undergoes complete normalization, decoding all hex-encoded variables (e.g., transforming %2f back into a / directory separator). Because the security tier has already flagged the request session as validated or authentication-waived, the backend processes the newly decoded, high-privilege API path directly. The request executes with administrative system privileges because no session credentials were bound to the authenticated-by-default container context.

To understand the implementation flaw, we can analyze the differential behavior between the vulnerable authentication filter and the backend parser logic. In the vulnerable implementation, the application relies on standard servlet URI retrieval helper methods without enforcing strict normalization.

// VULNERABLE COMPONENT: AuthenticationFilter.java
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) 
        throws IOException, ServletException {
    HttpServletRequest httpRequest = (HttpServletRequest) request;
    // Retrieve the raw request URI without decoding/normalization
    String requestURI = httpRequest.getRequestURI(); 
 
    // The check fails to normalize percent-encoded sequences like %2f or %2e%2e%2f
    if (isPublicEndpoint(requestURI)) {
        // Request bypasses the authentication validation routine
        chain.doFilter(request, response); 
        return;
    }
    
    // Standard session validation occurs here for matched protected endpoints
    validateSession(httpRequest);
}

// PATCHED COMPONENT: AuthenticationFilter.java
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) 
        throws IOException, ServletException {
    HttpServletRequest httpRequest = (HttpServletRequest) request;
    
    // Secure Implementation: Canonicalize, decode, and normalize the URI before evaluation
    String normalizedURI = canonicalizeAndNormalizeURI(httpRequest.getRequestURI());
 
    if (isPublicEndpoint(normalizedURI)) {
        chain.doFilter(request, response);
        return;
    }
 
    validateSession(httpRequest);
}
 
private String canonicalizeAndNormalizeURI(String inputUri) {
    if (inputUri == null) return "";
    // 1. Perform URL decoding to resolve all percent/hex encodings
    String decoded = URLDecoder.decode(inputUri, StandardCharsets.UTF_8);
    // 2. Perform secondary decoding to handle double-encoded characters (%252f)
    decoded = URLDecoder.decode(decoded, StandardCharsets.UTF_8);
    // 3. Normalize relative path traversals (e.g., resolving "/..//" and trailing characters)
    return Paths.get(decoded).normalize().toString().replace("\\", "/");
}

This patch closes the parsing gap by ensuring both the security check and the backend router operate on the exact same canonical representation of the URI. Relative path segments and double-encoded sequences are resolved before any rule matches run, removing the bypass vector.

Exploitation of CVE-2026-76504 requires minimal configuration and no prior authentication credentials. The attacker crafts a unified HTTP request that routes through the vulnerable gateway.

The target endpoint is typically a sensitive REST API designed to accept CLI execution parameters or system diagnostic requests. Attackers construct the URI using an accepted public path prefix combined with a traversing sequence containing percent-encoded slashes. An example of a normalized logical path mapping is shown below:

https://<SD-WAN-Manager>/public-endpoint/..%2fdataservice/system/device/command

When the front-end routing rule processes the request, the URI is deemed a sub-resource of /public-endpoint and the authentication requirements are waived. Once past the filter, the back-end application decodes the request path, translating %2f back to / and resolving the relative parent directory sequence (..). The resolved request is treated as a high-privilege REST command executing under the administrative system context. The following execution parameters are representative of commands observed during scanning and active abuse:

# Attacker attempts to dump running configuration
curl -k -X POST "https://manager.example.com/public/..%2fdataservice/system/device/command" \
     -H "Content-Type: application/json" \
     -d '{"command": "show running-config"}'

Beyond simple reconnaissance and active credential extraction, threat actors can weaponize this path-traversal flaw to initiate destructive management actions such as executing database commands or executing device-level restarts.

A successful compromise of the Cisco Catalyst SD-WAN Manager represents a complete failure of confidentiality, integrity, and availability within the SD-WAN fabric. Because the management plane controls the control-plane keys, security policies, and WAN Edge router routing tables, an attacker holding administrative access to this system can completely control corporate network paths.

Attackers can leverage this position to inject routing configurations designed to intercept or mirror enterprise site-to-site communication, bypassing transport encryption security guarantees. In addition, access to SD-WAN Manager enables configuration manipulation on all downstream edge devices. This can lock out legitimate administrators, wipe operational configurations, and render physical and virtual networking endpoints offline.

The inclusion of this vulnerability in the CISA Known Exploited Vulnerabilities (KEV) Catalog highlights that exploitation is actively occurring in wild scenarios. A three-day binding remediation window was mandated, illustrating the extreme operational risk posed by unpatched management interfaces.

There are no official, viable long-term workarounds for CVE-2026-76504. Organizations must apply official vendor-supplied patches immediately to ensure remediation. Security administrators must identify running software versions and transition them to the corresponding fixed releases.

If immediate patch application is impossible due to change control constraints, temporary mitigations must focus on restricting the physical attack surface:

1. Network Access Control Lists (ACLs): Restrict access to the Catalyst SD-WAN Manager web-based user interface to verified management IP addresses. External internet exposure must be disabled entirely.

2. VPN and Bastion Architectures: Place the SD-WAN Manager interface behind an authenticated VPN or bastion system, ensuring that attackers must authenticate at the network edge before interacting with the vulnerable web interface.

Following patch deployment, incident response teams must audit historical log repositories for signs of active exploitation. Specifically, inspect access logs for abnormal requests containing percent-encoded path traversal sequences targeting the HTTP interfaces of the system.