1.0 Introduction
Recently, Cisco has released security updates
to address a critical authentication bypass vulnerability (CVE-2026-76504) in
Cisco Catalyst SD-WAN Manager..
2.0 Impact
Due to
improper handling of URI encoding in the API session-based authentication
management, an unauthenticated remote attacker could send a crafted HTTP
request to bypass an authentication rule and gain access to the API with the
privileges of the admin user. As SD-WAN Manager controls the SD-WAN network, a
compromise may let attackers change configurations and affect connected
devices. The flaw affects SD-WAN Manager regardless of system configuration.
3.0 Affected Products
- Cisco Catalyst SD-WAN Manager versions before 20.9.10.1
- Cisco Catalyst SD-WAN Manager versions 20.12 to before 20.12.8.2
- Cisco Catalyst SD-WAN Manager versions 20.15 to before 20.15.6.1
- Cisco Catalyst SD-WAN Manager versions 20.18 to before 20.18.4.1
- Cisco Catalyst SD-WAN Manager versions 26.1 to before 26.1.2.1
- Cisco Catalyst SD-WAN Manager version 26.2
4.0 Recommendations
CyberSecurity
Malaysia encourages users and administrators to review the Cisco Security
Advisory and upgrade immediately to the first fixed release for their version:
20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 or 26.2.1. Releases
earlier than 20.9 must migrate to a fixed release. Cisco states that no
workaround is available. If internet access to SD-WAN Manager is required,
restrict it to known trusted hosts and place it behind a filtering device. If
compromise is suspected, collect the admin-tech file (request admin-tech) and
open a Severity 3 case with Cisco TAC, with the CVE in the title.
Kindly
refer to the following URL: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU
Generally, we advise users to be updated with
the latest security announcements by the vendor and follow best practice
security policies to determine which updates should be applied.
For further enquiries, please contact Cyber999
Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT
Web: https://www.cybersecurity.my
5.0 References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU
- https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-132/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76504