{"id":"CVE-2026-76504","published":"2026-09-30T13:17:20.247","lastModified":"2026-10-03T00:16:39.140","description":"A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.\r\n\r\nThis vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-177"],"vendors":["cisco"],"products":["catalyst sd-wan manager"],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76504","tags":["US Government Resource"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw is an authentication bypass vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager, allowing unauthenticated attackers to gain admin-level access. This matters because it significantly compromises the security of the system, enabling unauthorized access to critical functionalities.","exploitability":"Exploitation is relatively straightforward given the attacker can craft a specific HTTP request to bypass the authentication rule. The attacker must have network access to the API endpoint.","blast_radius":"If exploited, the attacker could gain full control over the affected system, potentially leading to data theft, system compromise, and disruption of services.","remediation":"Disable the affected API feature or restrict access to the specific API endpoint until a patch is available.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","api","web","cve"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-01T08:43:42.431Z"}}