CVE-2026-76504: Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerabi

Description

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cisco Cisco Catalyst SD-WAN Manager

Default version status: unknown

20.1.12affected
19.2.1affected
18.4.4affected
18.4.5affected
20.1.1.1affected
20.1.1affected
19.3.0affected
19.2.2affected
19.2.099affected
18.3.6affected
18.3.7affected
19.2.0affected
18.3.8affected
19.0.0affected
19.1.0affected
18.4.302affected
18.4.303affected
19.2.097affected
19.2.098affected
17.2.10affected
18.3.6.1affected
19.0.1aaffected
18.2.0affected
18.4.3affected
18.4.1affected
17.2.8affected
18.3.3.1affected
18.4.0affected
18.3.1affected
17.2.6affected
17.2.9affected
18.3.4affected
17.2.5affected
18.3.1.1affected
18.3.5affected
18.4.0.1affected
18.3.3affected
17.2.7affected
17.2.4affected
18.3.0affected
19.2.3affected
18.4.501_ESaffected
20.3.1affected
20.1.2affected
19.2.929affected
19.2.31affected
20.3.2affected
19.2.32affected
20.3.2_925affected
20.3.2.1affected
20.3.2.1_927affected
18.4.6affected
20.1.2_937affected
20.4.1affected
20.3.2_928affected
20.3.2_929affected
20.4.1.0.1affected
20.3.2.1_930affected
19.2.4affected
20.5.0.1.1affected
20.4.1.1affected
20.3.3affected
19.2.4.0.1affected
20.3.2_937affected
20.3.3.1affected
20.5.1affected
20.1.3affected
20.3.3.0.4affected
20.3.3.1.2affected
20.3.3.1.1affected
20.4.1.2affected
20.3.3.0.2affected
20.4.1.1.5affected
20.4.1.0.01affected
20.4.1.0.02affected
20.3.3.1.7affected
20.3.3.1.5affected
20.5.1.0.1affected
20.3.3.1.10affected
20.3.3.0.8affected
20.4.2affected
20.4.2.0.1affected
20.3.4affected
20.3.3.0.14affected
19.2.4.0.8affected
19.2.4.0.9affected
20.3.4.0.1affected
20.3.2.0.5affected
20.6.1affected
20.5.1.0.2affected
20.3.3.0.17affected
20.6.1.1affected
20.6.0.18.3affected
20.3.2.0.6affected
20.6.0.18.4affected
20.4.2.0.2affected
20.3.3.0.16affected
20.3.4.0.5affected
20.6.1.0.1affected
20.3.4.0.6affected
20.6.2affected
20.7.1EFT2affected
20.3.4.0.9affected
20.3.4.0.11affected
20.4.2.0.4affected
20.3.3.0.18affected
20.7.1affected
20.6.2.1affected
20.3.4.1affected
20.5.1.1affected
20.4.2.1affected
20.4.2.1.1affected
20.3.4.1.1affected
20.3.813affected
20.3.4.0.19affected
20.4.2.2.1affected
20.5.1.2affected
20.3.4.2affected
20.3.814affected
20.4.2.2affected
20.6.2.2affected
20.3.4.2.1affected
20.7.1.1affected
20.3.4.1.2affected
20.6.2.2.2affected
20.3.4.0.20affected
20.6.2.2.3affected
20.4.2.2.2affected
20.3.5affected
20.6.2.0.4affected
20.4.2.2.3affected
20.3.4.0.24affected
20.6.2.2.7affected
20.6.3affected
20.3.4.2.2affected
20.4.2.2.4affected
20.7.1.0.2affected
20.8.1affected
20.3.5.0.8affected
20.3.5.0.9affected
20.4.2.2.8affected
20.3.5.0.7affected
20.6.3.0.7affected
20.6.3.0.5affected
20.6.3.0.10affected
20.6.3.0.2affected
20.7.2affected
20.9.1EFT2affected
20.6.3.0.11affected
20.6.3.1affected
20.6.3.0.14affected
20.6.4affected
20.9.1affected
20.6.3.0.19affected
20.6.3.0.18affected
20.3.6affected
20.9.1.1affected
20.6.3.0.23affected
20.6.4.0.4affected
20.6.3.0.25affected
20.6.5affected
20.6.3.0.27affected
20.9.2affected
20.9.2.1affected
20.6.3.0.29affected
20.6.3.0.31affected
20.6.3.0.32affected
20.10.1affected
20.6.3.0.33affected
20.9.2.0.01affected
20.9.1_LI_Imagesaffected
20.10.1_LI_Imagesaffected
20.9.2_LI_Imagesaffected
20.3.7affected
20.9.3affected
20.6.5.1affected
20.11.1affected
20.11.1_LI_Imagesaffected
20.9.3_LI_ Imagesaffected
20.6.3.1.1affected
20.9.3.0.2affected
20.6.5.1.2affected
20.9.3.0.3affected
20.4.2.3affected
20.6.3.2affected
20.6.4.1affected
20.6.3.0.38affected
20.6.3.0.39affected
20.3.5.1affected
20.3.4.3affected
20.9.3.1affected
20.3.3.2affected
20.6.5.2affected
20.3.7.1affected
20.10.1.1affected
20.6.5.2.1affected
20.3.4.0.25affected
20.6.2.2.4affected
20.6.1.2affected
20.11.1.1affected
20.9.3.0.5affected
20.3.4.0.26affected
20.6.5.1.3affected
20.6.3.0.40affected
20.1.3.1affected
20.9.2.2affected
20.6.5.2.3affected
20.6.5.1.4affected
20.6.5.3affected
20.6.3.0.41affected
20.9.3.0.7affected
20.6.5.1.5affected
20.9.3.0.4affected
20.6.4.0.19affected
20.6.5.1.6affected
20.9.3.0.8affected
20.6.3.3affected
20.3.7.2affected
20.6.5.4affected
20.6.5.1.7affected
20.9.3.0.12affected
20.6.4.2affected
20.6.5.5affected
20.9.3.2affected
20.11.1.2affected
20.6.3.4affected
20.10.1.2affected
20.6.5.1.9affected
20.9.3.0.16affected
20.6.3.0.45affected
20.6.5.1.10affected
20.9.3.0.17affected
20.6.5.2.4affected
20.6.4.0.21affected
20.9.3.0.18affected
20.6.3.0.46affected
20.6.3.0.47affected
20.9.2.3affected
20.9.3.2_LI_Imagesaffected
20.9.3.0.21affected
20.9.3.0.20affected
20.9.4_LI_Imagesaffected
20.9.4affected
20.6.5.1.11affected
20.12.1affected
20.12.1_LI_Imagesaffected
20.6.5.1.13affected
20.9.3.0.23affected
20.6.5.2.8affected
20.9.4.1affected
20.9.4.1_LI_Imagesaffected
20.9.3.0.25affected
20.9.3.0.24affected
20.6.5.1.14affected
20.3.8affected
20.6.6affected
20.9.3.0.26affected
20.6.3.0.51affected
20.9.3.0.29affected
20.12.2affected
20.12.2_LI_Imagesaffected
20.6.6.0.1affected
20.13.1_LI_Imagesaffected
20.9.4.0.4affected
20.13.1affected
20.9.4.1.1affected
20.9.5affected
20.9.5_LI_Imagesaffected
20.12.3_LI_Imagesaffected
20.12.3affected
20.9.4.1.3affected
20.6.7affected
20.9.5.1affected
20.9.5.1_LI_Imagesaffected
20.9.4.1.6affected
20.14.1affected
20.14.1_LI_Imagesaffected
20.9.5.2affected
20.9.5.2.1affected
20.9.5.2_LI_Imagesaffected
20.12.3.1affected
20.12.4affected
20.15.1_LI_Imagesaffected
20.15.1affected
20.9.5.1.4affected
20.9.5.2.7affected
20.9.5.2.13affected
20.9.6affected
20.9.6_LI_Imagesaffected
20.9.5.2.14affected
20.6.8affected
20.12.4.0.03affected
20.16.1affected
20.16.1_LI_Imagesaffected
20.12.4_LI_Imagesaffected
20.9.5.2.16affected
20.12.4.0.4affected
20.12.401affected
20.9.5.3affected
20.9.5.3_LI_Imagesaffected
20.12.4.1_LI_Imagesaffected
20.12.4.1affected
20.9.5.2.21affected
20.9.6.0.3affected
20.12.4.0.6affected
20.15.2_LI_Imagesaffected
20.15.2affected
20.12.4_Monthly_ES5affected
20.12.5affected
20.12.5_LI_Imagesaffected
20.9.7_LI _Imagesaffected
20.9.7affected
20.15.3affected
20.15.3_ LI _Imagesaffected
20.12.501affected
20.12.5.1_LI_Imagesaffected
20.12.5.1affected
20.12.5.2_LI_Imagesaffected
20.12.5.2affected
20.15.3.1affected
20.15.4_LI_Imagesaffected
20.15.4affected
20.9.7.1_LI _Imagesaffected
20.9.7.1affected
20.18.1affected
20.18.1_LI_Imagesaffected
20.12.6_LI_Imagesaffected
20.12.6affected
20.12.5.1.01affected
26.0.1affected
20.9.8affected
20.9.8_LI_Imagesaffected
20.18.2affected
20.15.4.1_LI_Imagesaffected
20.15.4.1affected
20.18.2_LI_Imagesaffected
26.1.1affected
26.1.1_LI_Imagesaffected
20.18.2.1_LI_Imagesaffected
20.18.2.1affected
20.15.4.2_LI_Imagesaffected
20.15.4.2affected
20.12.6.1affected
20.12.6.1_LI_Imagesaffected
20.12.5.3affected
20.12.5.3_LI_Imagesaffected
20.9.8.2_LI_Imagesaffected
20.9.8.2affected
20.18.3affected
20.18.3_LI_Imagesaffected
20.15.5affected
20.15.5_LI_Imagesaffected
20.12.7affected
20.12.7_LI_Imagesaffected
20.9.9affected
20.9.9_LI_Imagesaffected
20.18.2.2affected
20.18.2.2_LI_Imagesaffected
20.12.5.4affected
20.12.5.4_LI_ Imagesaffected
20.12.7.1_LI_Imagesaffected
20.12.6.2_LI_Imagesaffected
20.12.7.1affected
20.15.5.1affected
20.15.4.3affected
20.15.4.3_LI_Imagesaffected
20.15.5.1_LI_Imagesaffected
20.12.6.2affected
20.15.5.2affected
20.15.5.2_LI_Imagesaffected
26.1.1.1_LI_Imagesaffected
20.15.4.4affected
20.15.4.4_LI_Imagesaffected
26.1.1.1affected
20.9.9.1_LI_Imagesaffected
20.9.9.1affected
20.18.3.1_LI_Imagesaffected
20.18.3.1affected
26.1.1.2affected
26.1.1.2_LI_Imagesaffected
20.15.4.5affected
20.15.4.5_LI_Imagesaffected
20.15.5.3affected
20.15.5.3_LI_Imagesaffected
20.12.7.2_LI_Imagesaffected
20.12.7.2affected
20.9.9.2affected
20.9.9.2_LI_Imagesaffected
20.15.6affected
20.15.6_LI_Imagesaffected
20.18.4_LI_Imagessaffected
20.18.4affected
20.12.8affected
20.12.8_LI_Imagesaffected
20.18.4_LI_Imagesaffected
20.12.8.1affected
20.12.8.1_LI_Imagesaffected
20.9.10_LI_Imagesaffected
20.9.10affected
26.1.2_LI_Imagesaffected
26.1.2affected
20.15.6.0.5_PSIRTAUGaffected
20.18.4.0.5_PSIRTAUGaffected
20.12.8.1.1affected
20.9.10.0.01affected
26.1.2.0.02affected
26.2.1_LI_Imagesaffected
20.18.4.1.01affected
26.1.2.1_LI_Imagesaffected
20.15.6.1_LI_Imagesaffected
20.18.4.1_LI_Imagesaffected
20.9.10.1.01affected
20.15.6.1.01affected
26.1.2.1.01affected
20.12.8.2.01affected

CVE-2026-76504

Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability

Description

Affected products

Cisco Cisco Catalyst SD-WAN Manager

References