REVENGE OF THE SD-WAN: EXPLORING AND EXPLOITING YET ANOTHER CRITICAL CISCO SD-WAN VULNERABILITY (CVE-2026-76504)

Summary from the TLDR InfoSec newsletter

A single unauthenticated POST to /%6a_security_check mints an admin session on Cisco SD-WAN vManage through CVE-2026-76504, a critical authentication bypass Cisco disclosed on September 30 as an exploited zero-day. Cisco's login module checked the raw request URI while WildFly matched the decoded path, so the encoded request skipped the password check and fell into a session-continuation branch that trusted hardcoded internal usernames like viptela-reserved-cloudops. With ~1,500 vManage instances internet-exposed per VulnCheck, defenders should follow Cisco's advisory and hunt serviceproxy-access.log and vmanage-server.log for encoded j_security_check paths and viptela-reserved- usernames.