First published 9/30/2026, 5:36:15 PM · Last updated 9/30/2026, 5:36:15 PM

CVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated remote attacker to access an affected system with admin privileges due to improper handling of URI encoding in an HTTP request. The advisory instructs applying vendor mitigations, following CISA BOD 26-04 guidance and forensics triage requirements, evaluating internet exposure, and discontinuing use if mitigations are unavailable.

Categories: technology

Generated scores

Scores are based on the cited reporting and use a 1–10 scale. Read the methodology.

Confidence: 6/10How certain the assessment is based on the clarity and evidence in the cited reporting.
Geographic reach: 1/10How widely the event reaches, from a local area (1) to worldwide impact (10).
Global importance: 4/10The event's broader significance, from limited importance (1) to major global importance (10).
Impact magnitude: 6/10The scale or severity of the real-world impact, from minor (1) to extreme (10).
Positivity: 2/10How harmful or beneficial the event is, from strongly harmful (1) to strongly positive (10).
Urgency: 6/10How time-sensitive the event is, from low urgency (1) to immediate attention needed (10).

Why it matters

Unpatched systems could permit unauthorized administrative access, so stakeholders must apply mitigations and follow CISA patching guidance.

Location

Sources

CVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

Report an issue