Revenge of the SD-WAN: Exploring and Exploiting Yet Another Critical Cisco SD-WAN Vulnerability (CVE-2026-76504)

What it is

CVE-2026-76504 is a critical unauthenticated admin-session bypass in Cisco SD-WAN vManage, disclosed by Cisco on September 30, 2026 as an exploited zero-day. Cisco's advisory classifies it as CWE-177 (improper handling of URL encoding). VulnCheck found about 1,500 internet-exposed vManage devices. The page says exploitation has not been attributed to any actor, and as of October 1 no legitimate public exploit exists. VulnCheck reviewed at least one fake public exploit and rejected it.

How it works

• A POST to /%6a_security_check passes WildFly's security-constraint matcher, which decodes the path and treats it as the login endpoint.
• AppServerLoginModule.login() then tests the raw getRequestURI() for the literal j_security_check. That test fails, so loginUser() and the password check never run.
• Execution falls into a branch meant for continuing an already-trusted session. Its only real gate is isInternalUser(userId), a substring contains check against AdminConstants.INTERNAL_USERS.
• That list has four entries: viptela-reserved-dca, viptela-reserved-cloud, viptela-reserved-cloudops and viptela-reserved-uc. Any of them as j_username gets a session, and the password value is ignored.
• RBAC still applies. The dca and cloud sessions got "Access forbidden: role not allowed" on /dataservice/admin/user. The page says cloudops and uc have the needed permissions, but only cloudops was demonstrated, and the page text doesn't show the final admin response.

What to do

There is no patch or fixed-version information on the page, so check Cisco's advisory for that. The page offers these detection pointers:

• Review serviceproxy-access.log and vmanage-server.log, the two files Cisco's guidance names.
• Search for requests to /%6a_security_check and for viptela-reserved- usernames, which Cisco's IoCs also use as an anchor.
• The two login failure modes differ. A normal login with bad credentials returns Invalid username or password. The encoded path with a non-internal user returns LOGIN000 ... userInfo is null. The second response means the request reached the vulnerable branch.

VulnCheck gates the weaponized exploit, YARA rule, PCAP, ASM queries and Snort/Suricata rules to Initial Access Intelligence customers.

POST /%6a_security_check HTTP/1.1
Content-Type: application/x-www-form-urlencoded

j_username=viptela-reserved-cloudops&j_password=anything123

Caveats

• The findings come from VulnCheck's lab reproduction on a single OVA, not from observed attacker traffic.
• The page gives no affected-version range.
• VulnCheck is also a vendor selling the gated detection content.