CVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
Summary
Cisco Catalyst SD-WAN Manager has a hex encoding vulnerability that allows unauthenticated, remote attackers to gain administrative privileges. This is due to improper handling of URI encoding in HTTP requests.
IFF Assessment
The vulnerability allows unauthenticated remote attackers to gain administrative privileges, posing a significant risk to defenders.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: October 03, 2026. Known ransomware use: Unknown.
Defender Context
This vulnerability in Cisco Catalyst SD-WAN Manager allows for unauthorized administrative access, enabling attackers to potentially compromise network configurations and sensitive data. Defenders should prioritize applying vendor-provided mitigations and adhere to CISA's guidance on risk-based security updates to protect their infrastructure.