Revenge of the SD-WAN: Exploring and Exploiting Yet Another Critical Cisco SD-WAN Vulnerability (CVE-2026-76504)

Cisco Catalyst SD-WAN vManager’s login module and application server disagree about whether a request path has been URL-decoded yet. That single percent-encoded character gives us CVE-2026-76504. One unauthenticated POST with an arbitrary password triggers a critical authentication bypass that gives an attacker admin-level access to the entire SD-WAN fabric.